E.N.I.G.M.A 



EUROPEAN NUMBERS INFORMATION GATHERING & 
MONITORING ASSOCIATION 

Published July 1998 ISSUE 1 5 

IN THIS ISSUE OF ENIGMA 

°F/&lci)IE» TBftMSMITTgR SIT i LOCATED 1 
EE §HiP§ U®Ht ©M mm HR 






fcaNTLE^BN, Thebe'? ft 
fPY* IN yuPS'T.I 




OUR ADDRESS : (SI ENIGMA 



17-21, CHAPEL STREET, 
BRADFORD, WEST YORKSHIRE, 
* BD1 5DT, ENGLAND 



VIA E MAIL : — <p — <enigma.box@centrenet.co.uk> 

VIA FACSIMILE : « UK: 01274-779004 

OVERSEAS: 1 +44 1274- 779004 




^ INTRODUCTION 

ENIGMA is the journal of the European Numbers Information Gathering and Monitoring Association, 



ENIGMA is a non-profit making association of listeners who monitor and gather information on 
"Number Stations” and other related radio transmissions. ENIGMA aims to bring together listeners 
and enthusiasts and provide quality information on subjects not normally available from main-stream 
publications. In addition to our dedicated private readership ENIGMA is also purchased by 
Government agencies and oveiseas Embassies and Security Services. 

We aim to bring you the most accurate information available. The newsletter covers the preceding 3/4 
months monitoring so is always "up to date" wisest published, but due to the nature of the subject, 
schedules, operating patterns and habits are subject to change without notice! 

^ CONTRIBUTIONS 

We appreciate all contributions to the newsletter, especially from Europe, the Middle East, Far East & 
CIS, but all are welcome (including anonymous information). We regret that owing to the amount of 
information received we are not always able to provide a personal reply but, rest assured, we read, 
collate and index all information for present and future use. What may seem insignificant today may 
prove invaluable at a later date. Questions are mainly answered via our "Letters to ENIGMA" pages in 
the Newsletter. ENIGMA is also a discussion forum and we welcome comments about the newsletter, 
and "Numbers" monitoring in general. 

& HQW YOU CAN HELP ENIGMA 

In addition to your logs and letters we also collect ’cuttings’ and information about espionage for use 
in features. We need more Morse monitors and also readers who would be interested in concentrating 
on particular stations, either voice or Morse in order to leant more about their habits’. We are 
particularly keen to leant about transmitter sites in any country. If you are going on holiday please let 
us know what you heard, and if you are interested in writing a feature please contact our office. 

^► SUBSCRIPTIONS 

Four copies of ENIGMA are available for; GBP 6.00 UK Postage Paid 

GBP 10.00 Rest of World, Air-Mail 

Payments may he made by Sterling cash, US Dollars cash, Eurocheques or AMEX cheques (in 
Sterling), UK cheques or Postal Orders. Payable to "ENIGMA" 

^ BACK ISSUES 

Back copies of issues 9 to 14 inclusive are still available, while stocks last, at the following prices, 
inclusive of postage. Please allow up to 28 days for delivery. Issues 1 to 8 please enquire before 
ordering stocks are very low. 

UK Ov er seas 

Issues 9 to 14 each 1.50 GBP 2J5Q 

^ACKNOWLEDGEMENTS 

information in ENIGMA may be reproduced, but please mention ENIGMA and if possible the 
originator of the article. We would appreciate any cuttings in which ENIGMA is mentioned. 

^ CONTRIBUTION DEADLINE 

We aim to publish the next edition of ENIGMA in December 1998. Contributions would be 
appreciated by Saturday 14th November. Thank you. 

^ COVER ISSUE 15 

Illustration - 'Trouble with the Swiss Guards at The Vatican". See News Round Up. 
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STATION NEWS 



As announced in the last issue, the new combined Morse/voice reporting system is 
now being used. As a logical extension of this, stations will now be listed according to 
family (if known) rather than language/Morse. We will still use the same ENIGMA 
reference numbers, but now they will be listed under their respective family headings. 
To distinguish one family from another we have named them as far as possible after 
their country of origin, and given them each a number - in Roman numerals. 
(Individuals, or stations with no known family relationship are given the notation 'O’ - 
and can always be allocated to a family at a later date if necessary). 

Many of you, being used to the old system, may object to these radical changes, but 
in time we hope you’ll see the advantages of being able to gauge more clearly the 
overall activity of particular agencies. Many of our members find it difficult to relate 
one station with another in the same family. Many stations also share habits with 
other family members. We arc convinced that, once acquainted with this new system, 
numbers stations will be better understood and more easily found. 

Known families 

Only families/stations active at present arc listed here. For fuller information see our 
Control List 



I a 


CIS 


M14 (incl.M24) E6 E17? G6 S6 V6 // S25 


b 


CIS 


M12 E7 G7 S7 V7 // XP 


II 


USA 


E5 V5 


III 


'Strich’ 


M3 Ell Gil S12 


VI 


Germany E16 G16 


VII 


N Aida ? 


El? M17? 


VIII 


'YT 


M53? 


IX a 


Czech 


MIG S1G>// M7 


c 


Czech 


S17 


0 


Czech 


M39 (a one-off: may be IXa,c or neither) 


X 


British 


E3 E4 



XI 'Swedish Rhapsody’ M4 // E23 

XII Arabic E9 V8 

XIII '3 note oddity’ Hungary M29 G4 

XIV 'Ml family’ Ml M45 S21 

XV 'Edna Sednitzer M13 E18 G22 

XVI Romania? M63? (A2A) 

XVIII Cuban M8 V2 

XIX France M16//M51 

(// indicates that the following station is not a direct equivalent of those preceding) 

0 Ml 8 M21 M22 (4XZ Israel) M23 M26/34 M42 M52 M56 MX 
E10 El 5 S13 S14 S28 V9 V13 V15 V20 V21 X6 XC XF XM XX 

Other (rarer) stations in category 0 - especially Morse - are likely to be active. Major 



3 



6 

\ 

* 



losses over the past year have been the whole of Family IV (E12/M2), the sub-Family 
IXb (OLX), and what seems to be the last of Swedish Rhapsody, G2 - of which more 
later. 

The station news which follows isn’t as detailed as we would wish it to be. This is due 
to a backlog of schedule information which still needs processing. As usual, all we do 
is give an idea of the level of activity. Please don’t write in and say that there aren’t 
enough frequencies and times listed. The reasons are, as we’ve said before: 1. Many 
stations simply don’t lend themselves to this approach - they don’t behave like 
broadcast stations. 2. Many schedules running at present will be out of date by the 
time you read this. It is up to monitors to keep track of these. This is what we have 
to do. It’s not always easy, but once the habits of a station are properly understood it 
usually presents no great problem. 3. Some stations’ schedules don’t follow 
predictable cycles, so it’s a matter of luck when a new one is found. 4. The booklet 
should help a great deal in the understanding of Numbers Stations. 5. We don’t 
intend to repeat the same information from one issue to the next, as there is far too 
much of greater importance to cover. 

Lastly, the aim of ENIGMA is not primarily to publish 'times and frequencies’ - even 
if it were easier to do so. Our aim is to investigate Numbers Stations from every 
angle. In this way we differ from the run-of-the-mill 'utility/broadcast listing’ style. 
We serve a wider readership than merely hobbyist shortwave listeners. Such SWLs 
expecting to be told just when and where to locate particular numbers stations, 
however, are unlikely to find information of comparable quality in any other 
publication. 

* ******** ********************* ** ********* ********************* 

This is our first attempt at using this new system, and it is by no means perfect yet. 
In the next issue it is our aim to have all the station information fully integrated. 
Apologies for the teething problems. 

FAMILY I - Note. This is a very large family. Full details of its activity would fill 
this newsletter. Transmissions are tailored to the recipients’ requirements and 
schedules are very flexible. Many are weekly, some week-of-month, some monthly. 
Some schedules are inter-related, and share the same messages at times. The 
information given below is very brief, and not complete. A series of features on this 
family is really needed, but due to lack of time we don’t know when this will be. 
Collating logs, unravelling schedules and traffic analysis is very time consuming. A 
few pages of results don’t obviously reflect the many hours of preparation. These 
comments apply to many other stations also. 



FAMILY la 

Tire big news concerns S25. After years of daily transmissions these have now been 
reduced to weekly - on Mondays only. Same schedule (615): 0800 14890kHz, moving 
at 0820 to 11270kHz. Also, the complex variant formats, S25A & B, have not been 
heard for a year now. Presumably the reduction in operation means that 'messages’ 
of S25 are less urgent, or that the number of recipients has been much reduced. 
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Does one 'message’ serve for the whole week now? 






M14 - Some schedules this year so far: 143 168? 177 202 203 311 325 362 396 412 464 
491 (slow MCW) 494 ?514 517 541 560 571 591 631 633 738 786 863^ Interestingly, 
203 never includes null messages, and is a much longer schedule than most, having 
been running since February, and still here. This one transmits Wed & Thu 1800 & 
1900 - the latter time being on a lower freq. - a common feature of Ml 4. New 
message each week, three repeats. Schedule numbers (IDs) in this subfamily are 
time-dependent only - not freq.-dependent. Most lb schedules are both. 

Two of the above, 464 & 863, use the five spaced zero ending, pausing between each 
zero, (once known as M24) The reason for this is unknown. Schedule 560 always 
seems to send double messages. Here are its DK/GCs recently: 1st May 
319/82,422/61; 15th May 438/71,439/72 (is this a joke?!); 22nd May 349/71,891/72; 5th 
June 143/70,981/72. Only the 1st May transmission seems realistic. Note the very 
similar GCs, and those transposed DKs 439-349,891-981, and consecutive DKs 438/439. 
What on earth is going on here? Perhaps it’s all to stimulate speculation within the 
monitoring agencies! 

E6 - Schedules so far: 129 194 204 206 237 284 291 295 308 314 320 394 471 478 482 
506 592 609 614 641 682 683 702 709 715 735 738 821 ?825 843 856 915 ?946. 715 
has been running all year so far. Best times: 18-2200 all days of week. 

E6B - (NEW DESIGNATION) A new variant ‘format was logged on 5th February 
with call beginning at 2040 on 3820. "129 129 129 7432t>'' At 2044: "573 573 24 24’ 
then 24 x 5F as usual, 2573 573 24 24", then "129" repeated for about a minute, and 
"308 308 16 16" and 16 x 5F message, ending 308 308 16 16 00000 as usual. A double 
message on schedule 129 (a one-off schedule?), but what does the 5f call group 
represent? 

?E17 - Not often logged in Europe due to its preference for the early hours of the 
morning Sparse logs include: Mon 0200 7775, Mon 0410 7944, Fri 0200 5208, Fri 
0300 4518, Sun 0400 6250, Sat Q700 7035 - in amateur band. Although E17’s format 
is identical to the others in this subfamily, its habits (including scheduling) and 
technical quality are quite different. All other family members are noted for their 
reliability and excellent transmission quality. ID s this year: 167 247 989 ???. 

G6 - Schedules so far processed: 076 907 Best times: Mon 19/2000 , 1900 & 2000 1st 
MON & TUE of month. One monthly message, three repeats. Has also been 
reported on SAT. This and V6 are the least busy of la stations. 

S6 - Schedules so far: 102 163 254 385 432 482 502 621 624 659 714 719 ?726 731 826 
842 852 971. Best times: Mon 21-2230, Tue 18-2130, Wed 1630-21, Thu 2000, Sat 
0900 & 1800, Sun 0500 & 2100. 

A very strange-sounding S6 appeared on Tue 7.4 2100 on 5125kFIz: 971-472/30, 
repeating at 2200 on 4504kHz. Throughout both transmissions there was a rythmic 
scratching noise keeping time with the groups. The first tr. ended with only three 
zeroes - an error. The second tr. ending in the usual five. About 20 seconds later 
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the scratching stopped leaving a clean carrier. Technical faults are almost unknown 
on the Russian stations. The scratching was most probably caused by a drum 
recorder, which for some reason was brought back into service. 

S6C - A few of these oddities have popped up. e.g. TUB 14th April at 0535 on 
7590kHz: "11715". No pattern to these transmissions has yet been identified. 

S25 - See above. 

V6 - Schedules processed so far: just one and a 'missed ID’, 728 ??? FRI 1900 The 
least active of Family I stations, but still running at least one regular schedule. 

FAMILY lb 

M12 - Still the busiest of all the Russian stations with many schedules running. Some 
of these are 'special’ schedules which don’t conform to the usual habits of this 
sub-family. The main ones of which are 658 & 749 (which are linked), 963 which has 
a long-term frequency use and until recently, a nonstandard repeat pattern, and also 
the very long-running schedule sending the same message every week but changing its 
schedule number and frequencies at seasonal intervals. 

Many schedules in morse and voice have long been noted to use frequencies in which 
the primary, and each of the two repeats are related - the 10kHz & 1 kHz placings 
being the same. e.g. 13367-12167-11567. This example being June’s special M12 
schedule sending the very long-running 66 group message (DK always 792). For the 
June freqs. the SN is 315 - these three digits representing the 100kHz placings for the 
three freqs., i.e. 13367-12167-11567. Many other schedules use the same ID structure, 
so that once the primary freq. schedule is identified, the other two freqs. can be 
found easily. This is only the second case where we’ve noted frequency-related IDs 
being used - the other being where M45/S21 schedule numbers represent the last 
three Figures (100/10/1 kHz) of the lowest parallel. 

Some schedules operating this year include: 135 138 151 152 154 194 213 217 234 286 
287 304 326 366 416 418 426 486 595 608 691 715 719 724 754 767 772 782 812 
815(linked to 658/749) 825 845 870 935 936 940 941 945 946 963 949 986 

The endlessly repeated 792/66 message has changed schedule several times as usual - 
to enable best reception at its target location/s (1940-2000-2020UTC Sun, changing to 
18401900-1920 for summer months) Dec/Jan Sched No.: 304, Feb: 782, Mar: 213, Apr 
& May: 151, Jun: 315 - freqs being 1 3367-1 21671 1567. 

658 - Tue Wed 1400-1420-1440 on 13921-15720-14922? 

Mon Tue 1800 & 2100 on 6855-5790-4627 

Wed 2000 on 6934 

Sat 2000 & 2100 on 6855-5790-4627 

749 - Mon Tue Wed Thu Sat Sun 1600/1700 on 6782-7657-8171kHz 

These two schedules are interrelated and operate in a complex manner; they really 

need a feature of their own. 
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E7 - see also M12. Some Schedules logged this year include: 102 695 825 890 915 
916 919 946 948. Try 2000UTC Mon, Wed & Sun 

G7 - see also M12. Schedules this year include: 118 156 164 214 218 224 258 306 421 
464 485 522 577 621 631 696. Try 0630 Tue & Thu, 1900 & 2030 Thu, 1800 Fri, 0800 
Sat, 0700 Sun. Linked: 118/224 132/406 164/224 164/214 306/421 464/621 621/696 

§7 - see also Ml 2. Schedules this year include: 350 369 418 571 638(including a 
double message) 671 742 792 795 813 847 864 867. Tty 2030 MON, 0500 TUE & 
THU, 2100 MON. 

V7 - see also M12. Schedules so far this year: 118 275 398 541 572 654 725 749 893 
947. MON 2000. FRI 2000. TUE & THU 0600 Messages rare, nearly always nulls. 
Repeats follow normal family pattern. Jul 7 : 0600 11461-12061-1336 i?^ ^ in: 403 

XP (Polytone) - As polytone frequencies always follow the 'last two digits rule’ (i.e. 
10 & lkllz placings the same for primary and each repeat) does this mean that the 
Schedule Number is related (see M12 above)? If so, this means that the tones could 
all eventually be identified with their respective figures. This is assuming that tones 
are not reallocated with each new schedule, which is possible. The 0, 1 & space tones 
never vary, but the other seven may do - however, it is unlikely as this would involve 
reprogramming the resolver at the receiving end. Such reprogramming information 
would need to be passed to the agent in advance; there are many ways of doing this. 
Seeing that GC tones are omitted, is this to prevent tone identification, or merely 
because a GC is unnecessary when the message is being automatically recorded? 
There is no way we can tell. As the message is encrypted anyway, there’s no reason 
for tone identification to^kept secret, so there seems little point in reallocating 
tones,unless it is merely to add another layer 

June freqs.: FRI 0600 9394-11494-13394. Could the Schedule be 343? Also TUE 
2100. July 0600: 9441-11041-12141kKz 

All Family 1 schedules are subject to change, and need to be closely followed. Times 
given are only very rough guides. 

Signals usually very strong and of high quality. 

FAMILY II See further details under this heading. 

The CIA’s "Cynthia" (E5) and her much shyer Spanish sidekick 

<V5) 

Either Cynthia, or possibly her clone, have now taken over from the little German 
girl’s voice of Swedish Rhapsody - see Family XI for details. Surely this can only 
mean collusion of some kind between the two agencies. 

As many schedules come and go without rhyme or reason, it is hardly worth 
publishing details, as they become out of date veiy quickly. A very low GC of 34 was 
noted on a 9th March transmission - this is very unusual for this station. 
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FAMILY III - "Strich" 



Behaving in its usual predictable way. M3’s unpredictable 287 schedule has popped 
up again - daily as always, and never sending a message - at present at 1630 on 7256 
in the 40m broadcast band, having moved from 5830kHz. 

M3 - IDs operating this year: 010 Oil 012 013 015 016 017 018 019 / 035 / 040 041 
042 043 044 ?045 046 047 7048 7049 / 214 215(error?) 216 / 287 / 496 (Gil also) / 
503(slow) 7508 / 552 7503 7558 / 584 / 7621 624 / 741 742 743(MCW) / 976 ?m* 

7 = possibly active. Too many schedules to list details, mostly 0600-1000, 4-6MHz. 
Highest freq. at present: 10720kHz. 

Special ID 121 has not been logged this time, but could easily have been missed, due 
to its unpredictability. Messages sent at the usual levels, mostly in the usual periodic 
flurries. Special ID 287 is back again. It may never go away, as freqs. and times are 
very variable - DAILY as always, at present at 1630 on 7256kHz. 287 never sends 
messages, but is associated with MSA variant: 111 or 333/00. Some of the above IDs, 
also have never been known to send traffic, e.g. 214, 503, 624. Others rarely send 
nulls, such as 015, which may send two different messages within an hour, on 
different freqs. All message GCs over past 6 months have stuck rigidly between 5059, 
which is typical. (Only 121 regularly deviates from this range). 

Many of the schedules are following those of last year, but more significantly, 
messages are, in some cases, repeating group for group, those sent at the same time 
last year. E.g. TUE 2.6.98 0830 5550kHz: 015/54. The identical message was sent 
using a different ID in 1997: 5520 012/54. On WED10.6.98 1030 5180kHz: 041/50. 
The same message was sent on WED 11.6.97 on same schedule. Comments and 
speculation please. 

Ell - (231) is still around: FRI 2030 - 3060,4015,4780 or 5050 (depends on time of 
year) Weeldy 

Gil - (752) Weekly TUE 2100 - 3823,4015,4780 or 5050 
WED 0800 - 6430,7840 and others - Repeat 
(496) Weekly WED 0600 - 6750,7580 and others 

S12 - (971) First and third MON of month 2100 - 3823,4465,51 so 
First and third WED of month 2100 - 4015,5180 
(755) Not logged this year. Lost? Not operating? 

All these voice schedules have been running for years now and messages are rare. 

FAMILY VI - This section follows later. 

FAMILY VII 

M17 - Much busier than its voice counterpart. All schedules still operating as usual. 
A record 99 group message was sent on 22nd April, considerably higher than the 
typical GC of around 22. Recently some messages have followed on from one week 
to the next. No changes. 
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El ("Ready Ready!") - Only voice schedule operating appears to be 82 on Mon 
2130-2150-2210: 4740-4460-4270kHz. Will this be the next to go? Catch it while you 
can! 

FAMILY VIII - M53? 

The question mark says it all! We are not certain, but it is quite possible that M53 
could be part of the family which once included the extinct/dormant S8 (YT) and 
M27 (BTV). Several characteristics when taken together, support this suspicion: 1. 

Very stable long-term schedules. 2. Use of only two known freqs. - 6820(Winter) & 
8231(Summer). 3. Use of 3f random addressee numbers. 4. Low group counts typical 
of YT & BTV messages. 5. Unnecessarily 'fussy’ call and preamble, making the most 
of Morse procedure signals. 

Can be heard most days at 2000 & 2100 on 8231kHz (since 31.3). Always uses the 
same 'ID’ of 747, followed by one, or occasionally two, messages to different 
addressees. Repeats are sent on the following day, and like S8 & M27, messages are 
never 'carried over’ but are regularly replaced. A handkeved transmission was noted 
on 3rd Apfd . 

FAMILY IXa 

M7 - No change in activity. IDs 035 078 701 771 966 - not easy to catch these due to 
lack of call and only one minute of 'tone sequence’ before the preamble. For 
automated reception. 

M10 - Much easier to catch IDs due to 5min cail. As well asall the usual schedules 
still operating as predicted, there have been some very odd goings-on in recent 
months. Encrypted 5fig addressee numbers are being used for two anomolous 
schedules: 1000 on 5705//? and 1900 on 3824kHz. The 1000 schedule is daily - a 
departure from M10 habits. It also sends (short) messages to four addressees each 
time - never repeating - new messages daily. At 1900 , “ irregular, Several days/week* 

A peculiarity of both of these is that the 'circuit number’ is always 111 instead of the 
usual 555, At * 900 the GC is sent three times (each time) instead of twice, making it a 
variant format. 

Regular schedules operating this year (in order of 1st addressee): 107/859 249/487 
253 313 345 345/724 355/966 408/695 481/988 495/691 571/275/049/435 585/086 
661/423 667/988 752/903 771 783/961 866/844 905/423 966 ?/859 
All the above use two parallel freqs, one or both changing seasonally. Not all are 
weekly. Some operate seasonal cycles, others are continuous such as:- 

571/275/049/435 - weekly SAT 1645 4485//3385-5028kHz 
Repeating on SUN, MON & WED. (same time/freq slot) 

Some schedules repeat at different time/freq slots, a record 98 groups (903) on 21.4 

at 1710. 

S10t >- Regular schedule has been reduced to first (109) and third (247) Tuesday of 

month: 109/541 & 247/541 are both still operating, sharing time/freq slots. Addressee 
•^Transmissions are often Hand keyed , GC (always 30) repeated twice , not once. Tr 
ends (DK x2) 30 30 30 - without the usual three zeroes. Therefore new variant, M10D. 
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541 is always included. Moved from 44B5//3833 for summer. 

TUE & WED (Repeat) 0630 & 1530 - 4958/74485 

A mammoth 132 groups was sent to 109 on 5th May. 

FAMILY IXc - SI 7 

Still operating as usual. Daily at 1355-1402 on 5027//4485. Long-term analysis of its 
'messages’ is underway, and so far, has resulted in very interesting patterns. Details 
will be published at a later date. In the meantime, logs of this station would be very 
welcome - only daily 'message’ group required, as this is the only variable. 

1X0: M39 

Although definately one of the Czech family, it seems to be in a class of its own 
hence the odd designation. Several pointers give away its family relationship: 1. The 
use of rapid dashes between 'sections’ within its transmissions - a characteristic of 
former M7/M10 transmissions, now largely dropped. 2. Use of parallel freqs. where... 
3. one of its transmitters has a very distinctive clicking as if arcing is taking place in 
the PA stage. This peculiarity has also been noted on one of MIO’s two parallel 
transmissions. 4. Use of short zero. All these combined, 

especially No 3, confirm its identity. Its format also follows that of SI 8 , one of the 
rare 'Czech Man’ formats, which it may have replaced. If so, it is part of the 
subfamily IXa, however, not enough is known about S18’s habits to be sure on this. 
Scheduling provides no clues as M39 seems tooperate without one - both times and 
freqs are found by chance. Logs, therefore, are always sparse, and true activity levels 
will be higher than they appear. All we can say is that it’s still around with its usual 
unfathomable format: 3fig x3 followed by 5f x3, none of which are entirely random. 
Best times 0500-1 100, usually between 4 & 6MHz. 

Has been active several times this year 

FAMILY X - This section follows later. 

FAMILY XI - "Swedish Rhapsody" 

This station, noted for its stability, has recently undergone two radical changes. 

On 1st April the old schedules were entirely replaced, turning the unruffled world of 
Swedish Rhapsody upside-down. Perhaps the biggest change was the total extinction 
of G2A, whose schedule hadn’t altered for very many years. In the third week of 
April, all this changed again - this time, although the new schedules remained, the 
familiar 'little girl voice’ along with her musical toy disappeared and has not been 
heard since. Yet another blow to eccentricity which will be sadly lost. The voice in 
German has been replaced by that of the brash American English - Cynthia. What 
conclusions can we draw from this? 

Format has also changed - after a short settling down period. Gone are the single 
message voice transmissions; all are now of the 100/100/50 group triple type. 
Transmissions commence at 3 minutes to the hour with a call reminiscent of E5, 
however, no ID is included, and the counting is in the form of 5fig stutter groups, e.g. 
Hill 22222 33333 44444 55555 66666 77777 88888 99999 00000 repeated until the 
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hour. On the hour the three message headers (still encrypted 5fig) are read out three 
times, followed by the first header twice which is immediately followed by the first 
message (100 pairs, as usual). Without pause the second header is read out twice, 
and the second message follows immediately. The same applies to the third (50 
group) message, which ends abruptly, although the word "END" has also been noted. 
The main difference between this new format and the old one is the complete lack of 
pauses and announcements (no English equivalent of "Achtung!") - from beginning of 
traffic list to end of last message. Headers are read no differently as the message 
groups themselves, as if they were merely message groups. This gives the impression 
of one long 162 group message, which of course, it is not. 

What does this imply? It now implies moreso that all three message blocks are 
intended for the same recipients, and not separate addressees, as would be the case in 
a station like M10, S10, G3 or G8 for example. It also implies that blocks 2 and 3 are 
probably continuations (when needed) of the message encrypted in the first block. 
This means that the third block would always be the least likely one to carry valid 
traffic. The recipient would first of all transcribe the three headersas headings on a 
pre-printed (?) form. A grid of 100 spaces (10 x 10) below the first heading would 
then be filled in as the first block groups are read out. A prearranged Message End 
Marker, say a particular run of 3 figures (in clear), would be looked for by the 
recipient and at that point all further groups read out would be ignored, the receiver 
being switched off. The headers probably provide decryption information, and 
possibly also a (simply?) encrypted group count - in which case a Message End 
Marker would not be needed. The message ending could be marked at the 
appropriate grid square - these squares may even be numbered 1-150. Perhaps the 
need for three blocks is due to a need (added security? An inherent weakness of the 
system?) of the encryption system used, a system designed for a maximum of 100 
groups. Why is the final block only half the length of the other two? Maybe it’s a 
historical anomaly dating back to a period when time was needed to retune 
transmitters in time for the commencement of the lOmin tone period prior to the 
next transmission. A 100 group final block would leave very little time to arrange this. 
50 groups ending at h + 37.5, would make all the difference; it could be as simple as 
that. Maybe, for reasons unknown to the uninitiated, there is never any need for 
more than 150 groups, and this figure depends on a very specific kind of message - 
perhaps even so specific that precisely 100, 100 & 50 groups are always required, but 
this seems the least probable theory. We are open to further suggestions and wild 
speculations! 

M4 - only one message per month, w/c 2nd Sat of month MON - 100 group msg at 
0957 on 7250kHz. Repeated at: 1157 8188kHz, 1257 5748kHz; WED & THU - same 
times and freqs as Mon. MCW constant carrier as before. Format is identical to 
previous except that the lOmin of 'U’ now only lasts 3 minutes. 

E23 (NEW DESIGNATION) - Three messages per month, each of 100/100/50GC 
format:- 

1. w/c 1st Sat of month MON, WED & THU - 0957 6507kHz, 1157 8188kHz, 1257 
5340kHz - ali repeats of 0957 Monday. All USB. 

2. w/c 3rd Sat of month MON, WED & THU - 0757 4832kHz, 0957 6200kHz, 1157 
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8188kHz, 1257 6507kHz - all repeats of 0757 Monday - 12 transmissions in all! All in 
USB. 

3. w/c 4th Sat of month MON, WED & THU - 0757 5340kHz, 0957 8188kHz, 1157 
7250kHz. - all repeats of 0757 Monday. All AM. 

"Fifth weeks’ now carry no transmissions. Note: transmissions have only been heard 
on these three days of the week, and only during Central European office hours; 
draw your own conclusions! 

G2 - No longer operating. 

FAMILY XII - This section follows later. 

FAMILY XIII - VDE & "Three Note Oddity’ 



M29 (VDE) - M29A’s daily transmissions carrying weekly messages continue, 
changing frequencies monthly. So do the longer format type (M29), but these follow 
differentscheduling patterns. New message nearly always starts on Monday. 





JAN 


FEB 


MAR 




APR 


MAY 


JUN 


1800: 


3270 


3910 


???? 


1700: 


6590 


6640 


6529kHz 


2000; 


3200 


3470 


5460 


1900: 


5709 


???? 


6469kHz 


M29 


format 


is more 


often 


heard 


0700-0900. 


Repeats 30min later 100kHz away, 



Earlier in June there was a flurry of activity, e.g. THU 11.6 0700 5670: 23 35 11 
0900=, 0800 5750: 9 38 11 1000=, 0900 6470: 19 35 11 1100=, 1800 5420: 26 38 11 
2000= Purpose of first preamble element not known; 2nd is GC, 3rd is date, 4th is 
time - UTC + 2. Often starts at h + lOmin, repeating at h + 40. (4th element would 
then be xylO). July 1700 & 2000 slots: 6660-6509kHz 

Numbers stations sometimes break their own rules and on 9th June M29’s expected 
repeat 100 kHz lower down the band at 1030 didn’t materialise. In its place was G4 
with its 3 note tuning signal, followed by 34 groups* The same thing happened on 
11th June, an M29 at 1800 on 5420, was followed at 1830 by G4 on 5320kHz. A very 
unusual feature of M29/G4 messages on this day were that they were ail made up of 
seemingly random groups - apart from the first two groups, which were of the usual 
type. * NOT repeat of M2 9 msg* 

G4 (3 Note) - See also M29. Regular Sunday schedule continues. Messages change 
monthly along with freqs. Other schedules seem to be less long-lived, and are harder 
to pin down. 

JAN FEB MAR APR MAY JUN 
2105:3256 3265 4435 2005:4746 5410 5730kHz 

2135:3156 3165 4335 2035:4646 5310 5630kHz 

An analysis of messages has been undertaken, and will be published at a later date. 
Although sending 'message blocks’, this clearly not a "text type’ station, and its form 
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of 'encryption’ is unique. The same applies to VDE. 

FAMILY XIV 

Ml - 'A’ network operating predictably with its usual six slots per week, however, 
group counts have dropped from the regular 40, to between 30 & 40. 40s are actually 
rare nowadays. The same trend has been also noticed on 'B’ network transmissions, 
where often messages are very much longer than a particular schedule’s Standard GC. 
e.g. 325 (SGC 30) has recently sent a 53 group message. The Standard GC 'rule’ is 
no longer evident in many eases. Needless to say, we’ve no idea as to what this may 
mean! 

End-of-month transmissions follow their usual bewildering patterns. A promised 
up-to-date EoM list has has to be delayed again, but wc can supply it on request. 
EoMs certainly provide some interesting data. No EoMs were sent in June - just 
ordinary messages, both of Thursday’s being longer than the recent average: 44 & 42 
groups. Last year, the same thing happened in June - no EoMs. Perhaps this is their 
holiday month! 

'R’ Network schedules processed so far this year: 050 053 103 136 168 254 271 298 
302 317 325 382 419 514 594 719 729 745 871 913 931 Like the 'A’ network these 
are seasonal, but they all have their own cycles, e.g. 053 runs 7 months Aprii£>ctober, 
and is replaced by 325, November to April. 419 runs Nov-Feb, replaced by 271, 
Mar/Apr & Sep/Oct, and by 871, MayAug. Each schedule has its own freqs. Some 
use two parallels. 

Unlike the 'A’ Network which sends six different messages weekly - never repeated - 
'B’ stations will often carry over a message for several weeks, and may even share the 
same messages over roughly the same periods. This applies only to Related 
Schedules, e.g. 136, 419 & 514 are related - for most of February they shared the 
same message: 710/45. Previous to this they shared 517/43 (compiled on 12.1). 136 
actually started sending this on the 12th, 514 on 15th, yet 419 was still sending an 
earlier message (compiled 8.12) until 23rd Jan - leaving only 2 weeks for the 517/43 
message. Operation of Ml in all its aspects is extremely complex, and considering 
transmissions are hand-keyed, and certainly live in many cases, this makes it the most 
highly-organised family of them all. 

MIC has been active - as always highly unpredictable. It seems to use its own very 
large selection of IDs - they can hardly be termed Schedule Numbers, as no regular 
schedules exist. 

M45 - Still only paired with one S21 schedule. At present TUE & THU 1702 
5074//5474 Schedule Number being always now the last three figures of lowest freq. 
i.e. 074 For the time being 1st groups are random. 

S21 - Operating at least three regular schedules: 

TUE & THU 1742 4973//S373 SN: 973. Repeats M45 message. 

THU 1945 5290 Long-standing SN: 491 
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WED 2045 3160 Long-standing SN: 402 



The 1742/1842 TU E/THU 'slot’, which once remained unchanged for years, is now 
subject to frequent change: 

JAN/FEB 323 MAR/APR 454 MAY/JUN 973 
1842: 3323//3S23 4454//4854 1742: 4973//5373kHz 

Other rather elusive schedules have been noted: SAT 0815 5075//? (075) SAT 0915 
4832/73384 (384) but these do n’t seem to be regular. 

FAMILY XV 

M13 - Schedules this year include: 158 (no longer A) 183 ?228 ?252 253 254 261 272 
284 288 346 378 411 417 419 458 517 590 735(A) 714 732 915 946(A) 

590 still sends its longer than average (for M13) messages - 50-60 GC lately. 272 has 
now reached Serial No 205 (May) In March two messages were sent on 158, which 
had dropped its 000(M13A) format - 168/29 & 169/20. We’ve also partly solved the 
problem of where some of these IDs disappear to; they change Schedule Numbers 
while continuing with the same Serial Number sequence. Groups or pairs of 
Schedule Nos are related to one another and operate consecutively, clearly being 
aimed at the same recipient/s. At present, we can only predict some of these 
schedules a year in advance. More work is being done on this. 

E18 - Still around, but we’ve not been as diligent in keeping track of it as we should 
be! Last logged 12th March^OO (or 2310) 6464kHz. Monthly Schedule no. not 
known. Monitors desparately^as usual, for this and many other stations/schedules. 
The more of you who contribute, the more we can publish. There’s a strict limit on 
the amount of material that ENIGMA HQ and a few stalwarts can provide. We need 
much more active support - and will give advice when needed. 

G22 (RE-ACTIVATED) - Has been reported in recent months. Along with E18, 
these voice stations are far less active than their Morse counterpart, and tend to 
appear at 2200-0000 or 0400-0600. Frequencies change monthly. 

FAMILY XVI - Romanian 



M63 - The mysterious non-registered bogus callsign A2A is strongly suspected to be 
operated by Romanian intelligence, but as yet, very little is known about its activity. 
It seems to favour the lower freqs. - 3/4MHz region. Please send in all logs. 

FAMILY XV1H - Cuban? 



These very busy stations, presumed to be Cuban, do not all operate from Cuba, or at 
least this is what signal strengths in Europe imply. Best times for Europe: 0000-1100 



M8 - See last issue for reasonably full details. 

V2 - See above. As mentioned before, the final figure in the 5fig header always 
refers to the repeat number, e.g. 2 = 1st repeat, 3 = 2nd repeat. Thereare always 
two repeats of any message’s first transmission. However, recently a header ending in 
4 appeared. Was this an error? Compilation errors, at least as far as we can tell, are 
non-existent. Unfortunately, we have no logs of the companion 1st, 2nd & 3rd 
transmissions, so we cannot verify this. The original (non 150/150/150 group) format 
is still being used but is only occasional, and seems to be more often logged in USA, 
than in Europe. 

Minor "cosmetic’ schedule changes do take place. When we have time, we hope to 
analyse the vast quantity of data we hold on these stations. 

FAMILY XIX - French intelligence 

M16 (8BY) - Usual hourly transmissions. See previous issues for details. A "list’ as 
opposed to "text’ type station. 

M 51 - Usual level of activity for very long unbroken periods. One of the busiest 
stations, yet its scheduling is, so far, impossible to penetrate. Listing frequencies 
heard would be pointless. (4-6MHz region) Any time, any day. 

0: STATIONS NOT ALLOCATED TO FAMILIES 

By far the most active of these are the vast E10 (Phonetic alphabet - NATO-style) 
network, its "pre-NATO’ style rival E15 and the inscrutable shape-shifting M23. This 
section also includes The Buzzer (S28) and various miscellaneous Oriental and Morse 
stations 

/ 

Ml 8 no change. 

M22 -4XZ no change - as far as we know. 

M23 - See feature in this issue. See also M52 for a possible family link. As 
amorphous and frustrating as ever. Suspicions that an embryonic family is on the 
road to fruition, are getting stronger - see M52. This year has seen much perplexing 
activity. We can only list the highlights. 

First, the "non-news’. The "579’(null) schedule is still operating twice daily, and has 
been doing so ever since Februaiy last year, without a single message being sent. 
DAILY 0800 & 1400: 8307//9285kHz as we keep on reminding you! 

The frantic daily activity on 6999 has ended, along with somewhat less frantic, but 
related activity on 6430. No doubt they will be back. Various other (odd/even type) 
shorterlived schedules have been and gone. Most notable, though, is the daily 
(almost) schedule at 1500(summer, 1600 winter) 

on 7795. A most extraordinary sereies of transmissions which often repeat a day’s 
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message on the same day the following week, for up to eight weeks on a run. 
However, they went 'out of sync’ a while ago when a new Sunday schedule appeared 
(once only) but it doesn’t seem to put them off. This is an 'even ID only* schedule, 
where messages are always sent, (longest 129 GC). But, unlike the usual Odd/Even 
format, this one uses a different even 3fig ID for each message. Even more bizarrely, 
this schedule uses long pauses between elements. After the call, it is easy to imagine 
the transmission has stopped, similarly at the message end. Timekeeping isn’t a 
strong point - starts within 5min of nominal start time. 

M26 & 34 - When they’re around - impossible to miss. However, this isn’t a very 
frequent event, so logs are always sparse. An M34 sample: Mon 2.3 0820 5040 - "11 
27" repeated 5min - "11 11 11" then 13 x 5f. Message repeated, then "21 27 27", and a 
different 13 group message & repeat. (Not entirely random) Ends abruptly with last 
message group. 

M52 - A 'control’ type station. This rarity popped up on 6thFebruary 1700 
4060//3835 with "34:383622 383622 383622 AR". At 1800 changed to: "34:4914 44 
491444 491444 AR" until at least 2020. Again, on 29th June at 2000 on 7940//? For 
the first time we can provide details of the 'call’ for it does have one. As traffic is of 
the endlessly repeating type it was assumed that a call would be unnecessary. 
However, its operators evidently don’t think so, for until 2012 it was sending a 
repeated '55’. After a pause, this was followed by '10:441589 441589 441589 AR’ 
(pause) This was repeated continuously until at least 2115. As this station tends to 
send 'flurries’ of transmissions interspersed by long periods of inactivity, when heard, 
it is always worth searching for it over the next few days. Not surprisingly, it turned 
up again on 1st July ending at 1802 with '14:824393:26 AR 14:’, ending abrupt, just 
like that, in mid-flow. It was there again at 2110 sending,' 14:832233 AR’. 

More and more I suspect the master hand of M23 here, for M52 carries some of its 
idiosyncratic hallmarks. 1. Use of two parallel freqs. 2. Use of long zero. 3. The now 
revealed call. M23 has in the past used similar calls, such as 33 or 44. Only one 
other Numbers station uses two figure calls: M26/34. 4. Possible poor timing, when 
'message’ was intended to begin at 2010? This is typical M23 - not noted for its 
punctuality. In this case M52 probably started calling at 2002. 5. Use of the colon, 
very rarely used in Morse nowadays, and a British trademark (!!). M23 also uses this 
from time to time. 6. A suspiciously similar form of keying. We’ll say no more at 
this point, except that all logs are veiy welcome. 

M56 - very infrequent. No reports. 

MX - Single Letter Transmissions No great changes to report. All the clusters busy 
as usual, except 3595, closed for the season (?). The solitary R on 3323 went on one 
of its mad excursions for a while to 6642kHz. When it returned it was on 3321, not 
3323 - exactly half of 6642. Why? And why does it spend holidays in the 6MHz 
band, while its clones on 3196 and 4325 stay behind? This is the same wandering 
SLT which emigrated from 7452 a few years ago, where it had been for several years. 
4MIIz+ is a big jump at these frequencies. My favourite, L, still has its chirp; it 
wouldn’t be the same without iti 
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We were amused but not surprised by a comment in March 'Monitoring Times’ made 
by Hugh Stegman: (referring to the 8492 cluster) "These are single-letter channel 
markers for Russian Navy data or telemetry channels. They tend to cluster dose 
together in frequency". They are emphatically NOT what he says, as evidence so far 
is totally lacking. By repeating ad nauseum the same rumour it begins to stick and 
become irrefutable dogma. It is part of Numbers Station folklore, like that 
unforgettable classic "snowfall figures on Andorran ski-slopes" - so fantastic that it 
never caught on. Being more credible, the SLT myth is still doing the rounds. We 
could give other examples of this phenomenon too. BEWARE OF 
DISINFORMATION. Until any information we receive can be independently 
verified, we must treat it with caution, and notbe afraid to use the words, 'maybe, 
likely, possibly, probably’ etc. or 'we have been informed that’. We can confirm that 
certain individuals do feed ENIGMA with disinformation, (either cranks or pawns of 
the intelligence world) and sometimes we lay traps for them and sometimes they fall 
into them quite unwittingly. 

"They tend to cluster..." This is a generalisation. We cannot treat all as one. Only 
some SETs cluster. They play a very different role to other types which don’t, and 
are possibly completely unconnected. It is interesting that in an email from Anatoly 
Klepov listing Russian utilities contributed by Russian monitors, many stations are 
listed as Russian naval, but the four SLTs listed (different monitors) are merely 
named ' RUS SLHFM’. At least, it would seem, the Russians don’t follow like sheep! 
See article in last issue. 

Since that article, we have leamt of other cluster SLTs, inaudible in Europe. Takashi 
of Japan has logged the following: Band B - E,F,K,V Band C - C,F,K,M,P,S Band D 
- C,F,K,P Band E - C,F,P,S Band F - C,F,K,P,S Bands G & H - C,F,P,S. So 
possibly there are up to seven SLTs in each cluster. In recent months solitary Vs 
have been logged on 3316,4575 & 7002 (a new freq. - in amateur band). T has 
appeared on 7527. It’s wise to be wary of T & E reports as they may not be sending 
letters, but pips of some kind, and may not be SLTs at all. The E in cluster band B 
seems a possible SET, though, by virtue of merely being where it is. 

Another article is being prepared on these "Russian Naval Markers" - a vague and 
meaningless term, for what are they marking but the passing of time? 
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FAMILY II - CIA 

E5 COUNTING STATION 3/2F ENGLISH - Mode AM/SSB 

See also important news of new designation E23 under Family XI ’Swedish 
Rhapsody’. The 3/2F (E5) format is alive and well but traffic levels have fallen from 
an all time high in autumn 1997. There have been many changes to the operating 
schedule with each passing month, unlike last winter when things remained much the 
same the all way through. Some long standing frequencies have been discontinued; 
6970 kHz, which was used in the early evenings was a bad choice as it was usually 
flattened by the Romanian Press Agency RTTY station. Another schedule to end is 
the Sunday 16.00 transmission on 9070 kHz; this was one of the longest standing E5s 
and has had several different parallel frequencies over the years. 

We receive letters asking for us to publish the full schedule for E5. Unfortunately the 
schedule does not remain stable enough. Please see further comments in Letters page 
this issue. We will however look at collating those transmissions which are ’regular’ 
for the next issue and publishing these. 

V5 COUNTING STATION 3/2F SPANISH - Mode AM/SSB 

At one point it did appear that this format was in terminal decline in the Spanish 
language but we have received some reports and the transmissions do seem to still be 
active. Noted at 01. QQ 02.00 and 03.00 on TUE WED FRI & SAT. 

FAMILY VI - BNP 

El 6 - 2 LETTER - ENGLISH - Mode SSB 

The active calls in English are ECHO HOTEL, BRAVO LIMA & ALPHA 
UNIFORM. BL can be heard daily at 20.00 - noted using one of 11108 11545 or 
11617. AU was again active on 4821//4888 in March. EH can be found on the higher 
frequencies at either 15.30 or 16.00, noted on WED FRI & SAT. 

G16 - 2 LETTER - GERMAN - Mode SSB 

The active calls in German are GOLF KILO & WHISKY LIMA, GK is on several 
times some evenings and was noted at 19.30 20.00 20.30 21.00 21.30 22.00 and 22.30, 
several reports have also noted GK at 01.30 on TUE and SAT. Active GK calls 
include 316 571 750 856 & WL calls have included 522 and 550. Activity from this 
family is on the increase. Reports appreciated. 

Frequency list for E16 & G16. 2690 2707 2745 3228 3262 4543 4594 (4821//4888 AU) 
5015 5182 5732 5770 6370 6765 6853 7404 7532 7661 7740 7752 7858 8063 8173 9040 
9325 9450 10170 10460 10500 10740 11108 11545 11617 12092 12210 12314 13362 
13413 13752 13775 13890 14622 14945 15610 16055 16620 16414 17430 18195 18575 
19295 19755 20240 20350 20675 22885. 

Further news about 2 - letter stations in Simon Mason column this issue. 

FAMILY X - MI6 SEE ALS0 PAGE 61 for new * evelatiotls 
E3 ’LINCOLNSHIRE POACHER’ Mode SSB 

Intensive jamming from Iran seems to have finally made some impact on LP 
transmissions. The full schedule which was published back in Issue 13 continues to 
hold up well. The main news is that transmissions at 10.00 & 11.00 UTC seem to have 
ended. Those readers who have studied LP in detail will know that the 10.00 & 11.00 
transmissions are sent to headers D & H, however to avoid jamming D & H do also 
receive further messages included in the sliding schedule system. 



Lt is possible that transmissions may be taking place outside the 12.00 to 22.00 
schedule. Several years ago a set of transmissions also ran at 03.00 to 05.00. A further 
report mentioned hearing LP at around 07.50! On 14487. In the evenings jamming is 
also commencing at around 18.00 (previously 20.00) 

On some occasions recently only two frequencies are audible; it is possible that the 
third scheduled frequency may be switched to either a listed or unlisted frequency, ff 
you cannot find LP on any known frequency it may be worth trying to seek it out. 
One such frequency is 16314 kHz; this is used on some Tuesdays at 14.00 to substitute 
11545 kHz. Please advise if you note any frequencies which are not listed below, or 
when LP is noted off schedule - either frequency or time wise -from our Issue 13 
efforts. Frequency list: 

5422 5747 6485 6900 6959 7337 7755 8464 9251 10426 11545 12603 13375 14487 
15682 16084 16314 16475. In Issue 14 we mentioned data transmissions which take 
place at 48 minutes past the hour on LP transmissions. These consist of two 1 minute 
bursts of FSK. We have not had any feed back on this, could readers with decoding 
equipment have a listen to these and report? Thanks. 

F.4 ’CHERRY RIPE’ Mode SSB 

No major changes to report. Full known operating schedule is detailed below. Note 
15616 dropped and replaced with new 15624 kHz. 



00,00 01.00 10.00 11.00 12.00 13.00 22.00 23.00 MON to FRI only. 

15624 15624 10452 9263 8230 7484 9263 17499 Thanks to Simon, 

19084 19884 15624 13866 12056 11570 12056 20474 Ian & Takashi. 

22108 21866 17499 14469 13866 13866 15624 23461 



FAMILY XII 6647 & 11292 kHz 
RQ) MAONRTIC FIF.LDS Mode AM 

No reports received, may still be active on 6647 kHz on MON at either 18.00 or 19.00 - 
very erratic* 

VSI RASTRRN MUSIC STATION Mode A M 

This station is still active on the first SAT of each month at 19.00 in Winter & 18.00 
in Summer on 6645 kHz +/- 3kHz. Starting times are rather erratic and the quality of 
audio and and modulation is similar. Tapes played at the wrong speed and several 
false starts have become the norm with this Arabic language station (pity the agent). 
The SAT March 3 transmission suffered severe interference in the UK from a strong 
’R’ beacon which had taken up temporary residence on 6645 for several weeks. Can 
any readers confirm if the first FRI of the month transmission is still active on 11290 
kHz at either 08.20 or 09.20? On a recent SAT transmission strong broadcast audio in 
Arabic (?) followed the numbers message for about 1 minute. This suggests the 
transmitter is used for broadcasting purposes at other times. 

STATION NEWS - OTHERS 

These stations would appear to be individuals, and show no obvious sign of ’family’ 
relationships. 

R10 PHONFTTC ALPHABET - NATO STYLE - Mode AM 

Traffic levels continue to be high. The following frequencies have all been reported 



active in recent months. Callsigns vary. 

2270, 2626, 2743, 2943, 2953, 3090, 3150, 3270, 



3417, 3640, 3840, 4165, 4270, 4360, 



» 



5820, 6270, 6370, 6378, 6498, 6658, 6745, 6575, 7322, 7445, 7540, 7605, 7918, 8465, 
8642, 9130, 9402, 



10352, 11565, 12747, 12950, 1270, 13533, 15980, 17410, 17966, 19715. 
Message strings are still active and reports include; 



VLB 5007 1 900 
CIO 26B14L4416 
CIO 16B53T46 
CIO 24 
CIO 48L15 
CIO 16L12 



SYN 26T15P12D38 
SYN 26P15B38 
MIW 24 
M1W 64B4684 
KPA 20L 
KPA 32D21 



The less active callsigns have also been active including; ROV on 4604 and the new 
HNC - Hotel November Charlie on the frequency of 6575 kHz (further details about 
HNC in the Simon Mason’s column in this issue). Several 160 group messages noted 
recently - is this a record? 

Are these stations really Mossad? The suggestion that they are has been doing the 
rounds for years and like most things - once published somewhere the story sticks like 
glue! Certainly some of the signals do seem to emanate from Israel but reception of 
this network spans from South Africa to Japan and from Israel to the United States. 
ENIGMA has recently teamed about the ultra-secret KILOWATT NETWORK, a 
system not unlike that of SOUD (featured in this issue). The KW Network is made 
up of E?c countries, Israel, The United Stales and South Africa. Israel is a key 
player and with the other members gathers and exchanges information on countries, 
organisations and individuals which are considered a threat to the alliance. Veiy little 
is known about the organisation or its activities, its very existence is not public 
knowledge. Is it possible that the E10 stations are in fact part of this set up. Any 
information about the Kilowatt Network along with comments would be most 
appreciated. (Ed note: Canada, Norway, Sweden & Switzerland are members. The 
CIA & FBI are represented. Mossad & Shin Beth play a major role. 

R1 5) PHONETIC ALPHABET PRE - NATO - Mode SSB 

No major changes reported. Reception poor in Western Europe. Some reports 
indicate different callsigns to those regularly heard, the 11.00 BEC was heard calling 
RAS and the 21.00 MAS was heard calling OSS? 



Active are - 
11.00 BEC 


18000 


17.00 


FYP 


14000 


12.00 


USP 


17503 


17.30 


MSA 


5834 


12.30 


MSA 


11170 


18.00 


USP 


5834 


13.00 


BEC 


11000 


19.00 


SAR 


4130 


14.00 


FYP 


14000 


20.00 


NAS 


5530 


16.30 


MSA 


6716 


21.00 


MSA 


4130 



ALL DAILY 



VI 31 NEW STAR BROADCASTING - Mode A M 

Very well received in Asia, signals tend to be weak in Western Europe. Noted in 
Europe between 10.00 - 15.00 and also at 22.00. Frequencies in use are 8300, 8375, 
9725, 11430, 13750, 15388. 

transmission may start on the hour or at +30 minutes past. 



lo 



o 



VI 5) NORTH KOREAN - VIA RADIO PYONGYANG - Mode AM 
The following frequencies are all reported to be carrying numbers and have been 
monitored in Western Japan. 3250, 4770, 5715, 5870, 5885, 5910, 6215, 6400, 6600. 
Sometimes normal Radio Pyongyang & Korean martial music can be heard on these 
frequencies. Drifting on 5870, 5885 & 5910 is not unknown. Noted at 10.00, 12.00, 
13.00, 14.00 & 22.00. 

The main news about VI 5 concerns its use of 657 kHz MW . The station clearly has 
agents equipped with domestic receivers. The transmitter normally carries the 
domestic service in Korean for listeners in South Korea and Japan. The signal was 
reported to be very powerful in Western Japan at 15.00. 

VI 61 CHINESE - Mode AM 

The reception of these stations is very hit and miss in Europe and identification is 
very difficult. A possible V16 was noted on MON at 20.05 on 10125 - heard in 
Australia. Other reports are all unidentified but noted on the following frequencies; 
3084, 3570, 4130, 4360, 4649, 4770 (not Pyongyang), 8813. 

V20) BORED MAN SPANISH - Mode AM 

See feature in this issue. Operating on SUN at various times. 

SUN 13.25 4106//6868 Transmissions appear 1 hour earlier in Summer 
SUN 13.50 5135// ? to those noted in Winter. 

SUN 14.00 6868//? 

X6) THE 6 TONE REPEATING - Mode AM/ SSB The 6 Tone repeating signals are 
still widely reported. Some transmissions are followed by an FSK signal which appears 
between l and 2 minutes after the end of the AM 6 note signal. Some repeat in the 
hour. A transmission is noted below; no schedule has ever been established. This 
example shows that it is worth tuning around after hearing the 6 repeating tones. 
Example 

On TUE JAN 20th 19.07 6814 We received one report from Japan of a 6 

19.17 -5434 tone on 13924, are these signals heard in the 

19.24 5775 outside Europe generally? 

19.56 5393 

Do any readers have FSK readers? Sit on the frequency after the tones end - 
sometimes -after about 1 minute burst of hand-keyed Morse is sent followed by a 
FSK transmission. The 6 tones are, however very inconsistent in sending these 
messages. Presumably uses standard Russian shift/baud rate? We have made little 
progress in learning more about X6 stations. We were able to obtain a clear Morse 
transmission which sent the following message: (/ represent pauses in the 
transmission). 

RAD/ VV UU AS AR / RAD QSY 10111 QSY 10111/UU ASA/ RAD QSY 12067 
QSY 12067 SK NU - followed by FSK 

RAD would seem to be the callsign (making it Russian) and the requests are to the 
recipient to change to 10111 and then 12067 kHz. The ’0 ? in 10111 was sent as ’ — ’ 
single dash. 
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SIMON MASON WRITES . . . 



Helio again, and welcome to another column in the ENIGMA newsletter. 

♦ INTERNET First, some news for everyone who has access to the Internet. I 
have collated a Web page that includes the book "Secret Signais - The Euro 
Numbers Mystery" which you can read on-line for free. The publisher has said that 
it is now out of print, so I thought there would be no objections to having it on the 
Internet. Thanks to Gerry Dexter for his help. As well as the book, there are lots of 
other items, including full schedules of Lincolnshire Poacher (E3) courtesy of 
ENIGMA, a full Cherry Ripe (E4) schedule from Simon Denneen in Australia and 2 
Letter (E16/G16) schedules compiled by myself. There are also some photographs, 
including QSLs of OLX (S16/M6) and KKN44 (M25). In addition there is also one 
from a British Forces transmission on 6840 kHz, which came with a letter that said 
in part 'The transmitter that radiates this frequency is situated in Cyprus and the 
transmissions are directed toward the Gulf region". Sounds familiar! 

Other photographs of one time pads and a gigantic embassy log periodic antenna 
are shown as are various articles and letters. The address is - 
http://www.btinternet.com/ ~ simon.mason - then dick on the "Secret Signals" icon. 

♦ NEW PHONETIC ALPHABET (El 01 STATION FOUND - There I was minding my 
own business listening to the latest output figures of tractors, built at factory no.1 
on that most interesting and unbiased of stations - Radio Pyongyang, when out of 
the blue came a very familiar voice "HOTEL NOVEMBER CHARLIE -HOTEL, this 
was on 6575 kHz on 29 March 1 998 at 20.25 UTC. The transmission only lasted 3 
minutes. I then listened for the next few nights and was rewarded at 19.00 on 2 
April 1998 with "HNC-Z", again lasting only 3 minutes. Then on 9 April 1998, there 
it was again, this time for 6 minutes between 20.00 and 20.06 UTC with "HNC-A". 
Monitoring is still ongoing to try and establish a pattern, but it would seem to be 
one of those rare and infrequent stations like ZWL and NPD. It’s quite a good 
hiding place, under the sometimes quite strong Radio Pyongyang and I wonder 
what those dear listeners think of their favourite programmes being ruined by this 
Lady? 

Quite a few of these stations have sent rare messages during the last few months 
13 January at 19.15 on 5630 kHz - SYN had a 10 group message, MIW five days 
later at 19.15 UTC sent 73 - 5 Letter groups and VLB sent a to group message on 
31 March 1998 at 19.45 UTC. On 2743//4880 kHz at 20.00 UTC, ULX had a very 
long message, "Group 160" she said. Should be interesting I thought, there is no 
way that they can send a 160 group message, repeat it and get cleared in time for 
another message at 20.30 UTC. To add to the interest a sawtooth jammer 
appeared on 4880 kHz at 20.03 UTC, then at 20.22 UTC "Repeat, Group 160" was 
sent and the start of the message was broadcast, however, at 20.25 UTC the 
station suddenly left the air. At 20.29 UTC, the carrier of the jammer reappeared 
and at 20.30 UTC a very faint "ULX" could be heard with an 1 1 group message. At 
21 .00 UTC a stronger ULX sent 70 - 5 Letter groups. 
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♦ SWEDISH RHAPSODY - (G2/M4) I have been involved with some very 
interesting e-mail exchanges with numbers station enthusiasts in Austria. This ail 
came about when someone asked if anyone knew of an Austrian numbers station. 

I replied to the group saying that according to ’Langley Pierce’s book’ "intercepting 
Number Stations", the Swedish Rhapsody (G2/M4) station was operated by 
Austrian Intelligence. Several people asked for recordings of this station so they 
could assess whether or not the announcer had an Austrian accent, so I sent a 
sound file to them. The replies stated the announcer had no Austrian accent and 
indeed was not even a native German speaker at all. This seems strange as it has 
been on the air for so many years that it should have been identified by now in 
much the same way that other stations have been made. Of course, several 
theories have been proposed including Poland, Italy and Switzerland, but none 
have really been accepted as definitive, but one of these is much more likely than 
the others. Here are the comments of Jascha Ruesseler of Marburg, central 
Germany. T listen to this station regularly and for me (as a German) it does not 
sound like having an Austrian accent. That does not mean that it isn’t Austrian 
Intelligence. What I do know is that it has been active since at least the early 
1960s; its activities didn’t change after the German unification, and it is strong in 
central Europe. To my knowledge DF’ing attempts have not yielded definite 
results”. 

♦ MARK THOMAS COMEDY PRODUCT - Number Stations get their own TV series 
(kind of). In the recent comedy series shown on Channel 4 in the U.K., Mark 
Thomas an anarchic prankster had as part of his stage backdrop a large poster 
with a complete Lincolnshire Poacher call up and message, it also included the 
words “Gong Gong" inside a circle. No mention was made all the way through the 
series until, on the final programme, he said that some of his friends had asked 
him what the background was for. He then explained that it was a message from a 
Number Station, which were illegal and officially did not exist, although you could 
be prosecuted for listening to a non-existent radio station. It was a bit of a 
disappointment that he did not make more out of it; he probably only spoke about 
it for a few minutes. At the end of the programme the credits were rolled over 
more pictures of the backdrop and a 5 figure group repeating. I then speculated 
on e-mail that Akin Fernandez was probably behind it, as the backdrop was based 
on the message shown in his 4-CD Conet recordings. Akin replied that he wished 
that this was the case and that in a previous unrelated comedy series he had 
supplied the music from his studios. The producer of the Mark Thomas show was 
the same one as for the previous series and was interested in Akin's work, 
including the Conet CDs. The producer then decided that the Lincolnshire Poacher 
message was perfect for the show as it fitted in with Thomas’s trade-mark of 
"poking fun" at the "Establishment". Internet users can view the background for 
themselves at - http//www.fnord.demon.co.uk/second.html - This also includes a 
more complete version ol the tune playing along in the background. 
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♦ WHISKY LIMA (G161 PROPAGATION INTRIGUE - One of the German 2-Letter 
stations (G16), Whisky Lima shows very unusual frequency usage. The 10.00 UTC 
transmission every Sunday seems to be broadcast from the southern hemisphere. 
Let’s look at the frequencies used. In November and December 1997 heading 
towards mid-winter in the northern hemisphere, it’s on 20240 kHz, a very high 
frequency for winter, especially at sunspot minimum. In February 1998, it dropped 
to 19755 kHz. Spring arrives and it changes to 16220 for March and April. At the 
height of summer in June is uses 13890 and in July 12092 kHz. This is the 
complete opposite of what would be expected for a station operating in the 
northern hemisphere. Also, the time slot used could be an early evening 
transmission for the Far East and Australia. Contrast this with the WL broadcast on 
Thursdays at 19.30 UTC. a European evening slot. In January 7404 kHz is used 
compared with 13890 kHz for July’s transmission. This would mean that WL is 
used for two separate locations and I intend to see if the addressee 3F identifiers 
used are different for the two days, I suspect they might be. (They are Ed.) 

The English language station Mike Delta (El 6) also seems to be in the southern 
hemisphere. At 13.30 UTC in June it uses 12092 kHz, July 12210 kHz, August 
12314 kHz, September 14622 kHz, October, November and December 16220 kHz 
is used. MD has even been noted at 08.00 UTC in the middle of December on 
19295 kHz, while for the same time slot in July 12210 kHz is used, in contrast, 
Golf Kilo is a typical European station. From January to December at 19.30 UTC, 
the following sequence is used for the Sunday broadcast: JAN 3262, FEB 4888, 
MAR 5732, APR & MAY 7404. JUNE 8063, JULY 9325, AUG 7404 , SEPT 6853, 
OCT 5770, NOV 4888, DEC 3228 kHz. So it would seem that perhaps there has 
been a shift from Cold War days of operating in the European evenings on 3/4/5 
MHz frequencies to other more remote areas. 

Given that most Number Stations aim to hit their targets during the local evening in 
order to protect their cover, I suppose the following target areas are not out of the 
question: 

WL 10.00 SUN China WL 19.30 THU Russia MD 09.00 SUN China 

MD 13.30 THU Iraq GK21.30FRI Europe GK 01 .30 SAT U.S.A. 

BL 08.00/20.00 Daily, possibly Europe (prior to and after office hours) 

■ That’s about all for now, until next time my best wishes to everyone. 

A®. . . . 
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LETTERS TO ENIGMA 

A warm welcome to issue 15. Lots of letters to get through so straight in. First, two 
letters about the newsletter itself. We are going to take the unusual step of 
publishing the full text of a letter received from Harold in Southampton. We felt it 
raised some important issues and answering them via the pages of ENIGMA may 
be helpful to other readers. 

Harold writes: 7 thought I would take this opportunity to write to you to point out 
something that might have been overlooked in the Newsletter. Looking through the section 
dealing with the voice stations there is mention of plenty of frequencies relevant to a 
particular station even though that station may receive little attention from monitors 
because of language problems. 

t am not in the least against this even though if I heard V13 New Star Broadcasting it 
would mean little to me unless English was being used. V2 on page 12 of issue 14 
abounds with frequencies but is only of interest to those who speak Spanish. The Morse 
section is quiie another matter. Mi 2 on page 18 the author says is ’ Extremely Active ' but 
no mention of a frequency anywhere. The same goes for Ml 3 Ml 4/24 below : I have always 
regarded the Morse section as the poor relation of the voice section and would like to 
contribute logs of the Morse stations, but how can the author of this section tell us that a 
particular station is extremely busy and then say nothing about the frequency. 

i do realise of course that part of monitoring means that the operator must try and find 
frequencies for himself having done the job in the past professionally, but if the 
frequencies of M12 for example are known or even just a starting point why are they not 
mentioned. I know that you would like more logs from Morse monitors, but suspect that 
this is the reason that they are not forthcoming. Page 17 has a big section of MIG but 
nothing about where it may be found. 

New readers must be at a great disadvantage when reading the Morse section of ENIGMA 
if they do not have the back numbers to refer to, so one assumes that its of little use to 
them even though many may be proficient in the reading of the coda. Perhaps things will 
change for the better when you alter the format in the next issue 1 '. 

On a similar theme ’A’ from Oswestry Shropshire writes "Still mystified by the 
numbering system, but think I saw a reference to a kind of directory in the next issue. 
Hope that helps ' 

First of all then, let us start by saying that we do welcome constructive criticism of 
the newsletter. We hope to answer your comments in the forthcoming pages and 
also hopefully present some solutions. When ENIGMA was formed in 1993 it 
started out Jtas five A4 photocopied pages covering voice stations. It has 
progressed into a 60 page journal with the help and support of hundreds of 
readers who regularly contribute logs, news, features and dippings. In 1992 little 
had been published on the subject. A newsletter written by the late Havana Moon 
(much of which was amateurish and unreliable by today's standard) and Simon 
Mason’s ’Secret Signals’ represented about 90% of the reference material 
available. In Britain, magazines gave the subject a cautionary passing mention, 
partly due to the unease about the subject. 
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ENIGMA set out with the aim of collating the logs and schedules of stations in 
order to learn more about the habits of these peculiar stations. It was dear that no 
one monitor could listen to and log all the traffic, and ENIGMA provided a 
reasonable solution to this problem by attempting to schedule stations (however, 
this is rather more complex than we envisaged back at issue 3) At issue 3 Mike 
Gauffman joined ENIGMA and introduced the subject of Morse numbers stations (a 
crudal component) through a series of articles and format charts. It soon became 
clear that Morse traffic needed its own section which was duly introduced in issue 
6. Since this time Morse has remained a separate section in the Newsletter. It is 
through this process of evolution that we have reached our present position. 

Between issues 6 and 14, ENIGMA has grown from strength to strength and our 
understanding of the subject has grown with it. Three key points have become 
clear (details of which we hope will go a long way to answering the questions 
posed in the letters above). 

1 ) PRINTING SCHEDULES : Of the numerous stations operating, none are alike in 
their habits, they all have their own idiosyncrasies and complexities to unravel. This 
is where the challenge lies, for we must glean as much as possible with what 
initially seems very little to go on. We cannot treat them as we would broadcast, 
amateur or utility stations, for they are something totally alien and follow their own 
rules. We must adapt our mind accordingly and create order, where a casual 
monitor would only see chaos. With great patience and systematic logging we can 
discover these rules, predict schedules and analyse traffic. It is from this base that 
we should note that attempting to schedule some stations in the newsletter Is 
relatively easy; they use fixed frequencies and day/time slots. Others, however; are 
either tailored to the individual recipient or are maverick in nature with no 
identifiable schedule. There is little point in attempting to publish schedules for 
every station in ENIGMA, the use of frequencies can change from day to day along 
with the time slots and much of the information would be useless by the time it 
reached the printers. Others are better behaved but much work is often required in 
tracking them down, again the best we can hope to offer is an indication of the 
activity between each issue. This seems like a good point to assure readers in the 
clearest possible terms that your logs are important - even though they may not be 
published directly they are used to give a status level to the operation of a station 
or to indicate new schedules starting or ending. Other logs fill in missing parts to 
schedules or provide those welcome surprises when a maverick is re-discovered. 

2) PREVIOUSLY PUBLISHED INFORMATION : Earlier we used the word ’evolution’. 
It is true to say that information previously published can be difficult to find or non- 
existent if you do not have the relevant issue. It is to this end that we have 
prepared an ENIGMA booklet which we are sending to every reader. The booklet 
will pull together the following: 

a) The voice and Morse format chart with full cross references. 

b) Details on the scheduling habits of each family 

c) A list of ’fixed’ frequencies (where applicable). 



The nett result of the booklet is to reduce repetition in ’Station News’ and provide 
definitive information to assist in the identification and logging of known stations. 

3) FAMILIES : The introduction of families is the next step in the ’evolution' of 
ENIGMA. Previously we have iisted voice and Morse stations as separate entities. 
The new family system will aliow readers to see the whole picture, by operating 
agency, under one heading. 

We are always open to suggestions and welcome your comments on the above 
subject in future newsletters. 

A request now from ’S’ in Warwick concerning a computer game. He tells us that 
he was watching the popular television programme Games Master about games 
you can obtain for your P.C. and saw a P.C. Programme which was about the 
ENIGMA machine. It was animated and would take you through the operation of 
the machine, a sort of simulator for operators, if you did something wrong while 
you were using it an assistant would appear at a doorway and offer help. After 
training you would be given various encrypted messages you would have to 
decipher. Has anyone seen the game or similar? Is it still available? There is an 
ENIGMA simulator for the Atari ST available from Goodmans PDL. But it is not a 
patch on this P.C. programme. If you can help ’S’ please write via ENIGMA and we 
will forward your letters. 

A few quick greetings now. Hello to Enc in Vancouver, Canada. He tells us that he 

is originally from Whitley Bay in Northern England and has lived in Canada for over 
30 years and had an interest in radio for over 50 years. Staying in Canada, we also 
welcome Daryl in Toronto who aiso recently joined ENIGMA, we iook forward to 
your logs from that part of the world. Back to Britain, and David in Colchester, 
Essex comments, ’It was interesting to hear Simon Mason on Radio Netherland 
Media Network programme discussing Number Stations’. He also comments on 
our Direction Finding activities and offers his assistance. 

Staying on the DF subject, Harold writes from Giessen in Germany, “During WWII 
the British Navy developed a very good space-saving HF-RDF system called "High 
Frequency Direction Finder" (nick-named Huff-Duff), to be based on their ships for 
tracking down German U-Boats transmitting on shortwave". Further information can 
be found including drawings/plans and photographs of the Huff Duff system 
(which, by the way, is not an Adcock as mentioned in other books) in Arthur O. 
Bauer’s excellent new book “Funkspeilung als allierte Waffe gegen deutsche 
U-Boote 1939-1945.” In the UK details on DF may be found in Redgment, P.G.: 
High-Frequency Direction Finding. In: Kingsley, F.A. (ed.): The Applications of 
radar and other Electronic Systems in the Royal Navy in World War II, Basingstoke 
1 995. Do any readers have the exact address of the publishers of the latter? 

Further DF information can also be found in ’Operation Instructions for D/F outfits 
FH 4 with Switched Coils (B.R. 1442).’ Admiralty 1945. ’Journal of the Institution of 
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Electrical Engineering’ Part Ilia 94 1947, based on Proceedings at the Radio 
Communications Convention, March/April 1947. 

P.T.A. writing from Edinburgh also asks about DF information and is keen to make 
a start. We are addressing this matter - thanks for your interest. He also greatly 
appreciated the advanced notice about our appearance on the TV programme 
"Here & Now” last year. He also asks how ’old’ logs should be before they are no 
longer of interest? The answer is that we appreciate all logs between the 
publication dates of each issue - however - we are also very interested in historical 
information covering any period up to the present. This is vital for ongoing 
research, and cannot be emphasised to strongly. 

"Number Stations mentioned on RAi, the Ital ian Broadcasting Service" . Thanks to 
Andrea Borgnino, an Italian DXer who began working for RAI, the subject of 
numbers stations was covered on an official Italian station. Just a few minutes, with 
a couple of sound bites were given over in "Golem", a morning radio programme 
dealing with oddities in Television and radio programmes. 

Regular contributor Paui in London wrote to thank us for our feature on Iraq’s 
secret monitoring facilities ’Project 858' in the last issue. He has very kindiy sent 
us a copy of one of the personalised club cards for YI2AM (the former RAF 
monitoring station at Habbaniva. He also goes onto tell us about the book ’Secret 
Power’ - New Zealand’s role in the international Spy Network by Nicky Hager and 
published by Craig Potton Publishing. “My wife purchased my copy for Christmas, 
unfortunately I left my copy on the train; luckily this was the third time of reading. 
In keeping with modern practice it has not been handed in.” 

The book covers not oniy the input by NZ but feasibly the manner in which our 
own GCHQ operates. There are fourteen chapters, and five appendices, 299 pages 
in all. 

Chapter 2 outlines the spy network, and in particular, UKUSA. Chapter 3 reveals 
the way in which ECHELON functions and Chapter 4 explains the role of the 
UKUSA in the Cold War. 

in the remaining chapters the author looks at the secrecy rationale, the ’Lords and 
Masters’ who control the facilities, how the various styles of eavesdropping are 
carried out and exactly what the secrets are. (The information available in this book 
is a must for any person with an interest in the covered subject, you do not need a 
degree to surmise that one station’s function must be the same as another 
station’s within the alliance). Photographs and illustrations compliment the text. 
Acknowledgements are given to Duncan Campbell and Jeff Richeison and one 
forward is given by David Lange, Prime Minister of NZ 1984 to 1989. 

The book published in 1996 and now reprinted is available at a cost of NZ$ 26.50 
plus NZ$22 airmail or NZ$15 economy post. Craig Potton prefer payment by Visa 
or Mastercard, but will accept Postal Orders. 

Craig Potton Publishing Phone: 64-3-548-9002 

PO Box 555 Facsimile: 64-3-546-9192 
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Nelson email: info@cpp.nz 

New Zealand More info: http://www.fas.org/irp/eprirrt/sp/index.htmi 

Paul concludes. 'This is the best ever in factual writing on intelligence matters, that 
can be purchased. It is well worth the money and makes others look like poorly 
written novelettes". 

Greetings now to Lars (Germany). Thank you for your logs and letter. He tell us 
that he found the following in an old radio publication which mentioned 
transmissions by Interpol, which translated as follows: 'To keep clear an existing 
channel from other stations the central broadcaster transmits at short intervals their 
call sign in CW" - This is almost certainly HEP, but why from Switzerland when 
Interpol HQ is at Lyons - complete with 4 HF log-periodics? 

Quick hellos now to regular contributor Vassily (Moscow) and to Hans (Trier, 
Germany), thanks for all the logs which are most appreciated. Greetings to Gert in 
Holland and congratulations on your recent wedding. 

Staying in Germany, Kai sends us some interesting information about the 
espionage radio transmissions of the former DDR. The recently published book 
"100 Jahre Funktechnik in Deutschland - Funksendestellen rund um Berlin" 
describes in detail the SW facilities of the Ministerium fur Staatssicherheit (MfS at 
Zeesen. 

Zeesen is situated just a few kilometres south of Konigs Wusterhausen. in 1S36 a 
large SVV broadcasting facility was built (the same year as the Olympic Games in 
Berlin). In 1945, the whole equipment was confiscated and transferred to the 
USSR, the buildings and antennas were destroyed. 

In 1958, the DDR - PTT decided to re-establish a SW broadcasting facility at 
Zeesen. At an advanced stage the MfS stepped in and in 1960 opened its SW 
transmitting station. The station consisted of a transmitter building, a house for the 
emergency generators (6 turbo charged diesel units with a capacity of 960 kVA) 
and antennas. 

Until 1990, a total of 32 SW transmitters were in operation in all the usual modes. 4 
water-cooled transmitters from the USSR had a power of 25 kW, the remaining 
transmitters were air-cooled models, built in the USSR & DDR, with powers ranging 
from 1 to 20 kW. The transmitter hall was 50 x 14.5 metres and had a control 
cubicle in its centre. 

The antennas were installed on 62 masts of 30 metre height and three towers of 
45 metres height. In addition the station had a tower 59 metres in height for 
microwave links. The SW antenna array included 9 horizontal broad-band dipoles, 
8 verticals, 4 log-periodics and 9 rhombics and matrix switching facilities. 

ENIGMA readers will not be surprised to learn that the site was double fenced with 
floodlights. The transmitter house had a further tall high-voltage electric fence 
around it; in addition the site was patrolled and guarded by heavily armed guards. 
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In 1 990 the PTT took over the grounds again. The equipment was dismantled and 
part of the building is now used by the Deutsche Telekom telephone service. 

From Germany to Japan, and hello to Takashi in Nagasaki. A fine selection of logs 
and some interesting observations. Cherry Ripe (E4) is reported with powerful 
signals. Also reported coming in well are Counting Stations (E5). He asks for a full 
schedule! Sorry but this is not a station which remains constant enough. Please 
See earlier comments in response to letter from Harold. Lots of Phonetic Alphabet 
stations (El 0) confirming its worldwide coverage. 

Several stations which are based in Asia are also very busy. New Star Radio (V 13) 
is reported to be very powerful in the daytime. North Korean (VI 5) is still very 
active and is sending number transmissions on SW and on 657 kHz MW which are 
giving excellent reception in Western Japan. Cluster Beacons (MX) are giving 
interesting results with many beacons in the clusters which cannot be heard in 
Europe. The reception in Japan is as follows: (Those underlined not heard in 
Europe) 

5154 (E. F. K, V) . 7039 (C, F. K. M. P, S), 8039 (C, FJ<, P, S), 

10872 (C, F, P, S), 13528 (C, FJ<, P, S). 16332 (C, F, P, S), 

20048 (C, F, P, S). (Others heard in Europe not listed here). 



Back from the Far East now to the East of England and Peter (Saffron Walden) 
(Essex). A fine collection of logs and observations. Starting on Christmas Day 
when he remarks - " I made a point of listening on the evening of Christmas Day 
and it was obvious that the spy business doesn’t take a day off; I heard Counting 
Stations (E5), Russian Man (S7), German Lady (G7), two separate English Men 
(E6), Lincolnshire Poacher (E3) and jammer, M12 & even a German 2 Letter station 
G16). He goes on to comment on activity, Counting Stations (E5) in the shape of 
Cynthia continues her career; activity is down from the all time highs of the autumn 
of 1997. There have been many changes to the operating schedule with each 
passing month with some long-standing frequencies discontinued. Rather like 
some other stations, Cynthia likes to return to her old frequencies over time. 
Staying on E5 for a moment the call ’383' has been heard sending a message. 
’383’ in English and ’545’ in Spanish (V5) have the curious distinction of sending 
the familiar call up for 10 minutes but at the sound of the tenth ’tone’ abruptly 
going off air and never sending a single message. ’ 21 .00 UTC on 9090 kHz on 
SUN 5th April - ’383’. On previous occasions, when 383 was the "Call”, such as in 
FEB and MARCH 1993 - and earlier, as mentioned by Simon Mason in his "Secret 
Signals" book, the transmission terminated without a "Count 1 or a 3/2f message 
after the 10-minute "383” warm-up and went off. However, this was not the case 
this time, "383" being followed by “Count 175” and the usual 3/2f format’. 

He also comments on the major changes which have taken place by Swedish 
Rhapsody (G2/M4) - see station news . Following our feature on E5 over issues 13 
& 14 Peter has kindly agreed to put German Lady (G7) under the spotlight and we 
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will be carry this in issue 16. 

Greetings now to Andreas (Lands berg, Germany). He sent us a detailed letter and 
comments on the last issue. First off, the subject of whether listening to Number 
Stations is legal, a point raised by Peter in in issue 14. A recent court case in 
Germany raises some interesting points. The radio journalist Nils Schiffhauer won 
a trial against the authorities who wanted to procecute him for listening to Police 
frequencies. He also published frequencies and gave details of what could be 
heard in German radio magazine. The trial was, howeve.r a success for Nils. The 
judge ruled that "it is forbidden to listen to broadcasts not intended for the public, 
but how will the public know what is and is not intended for them?" The judge said 
"everything in clear speech seems to be intended for the public, and encryption 
systems should be used for all other transmissions - breaking these would be 
illegal." The judge recommended that ail systems in clear speech broadcast a 
message 'This broadcast is not intended for the general public" twice each 
minute". The same would apply to Morse stations, too (Ed.) Just imagine the 
incoven ience this would pose for agents taking down messages! So Germany is 
looking for a secure police communications system. Andreas suggests that 
Number Station operators broadcast such a message, otherwise it is legal to listen 
to them in Germany. He also comments on our new News Round-Up feature and 
hopes ft will become a regular slot. We have had a good response to this, please 
keep contributions coming in. 

On the subject of HF sites, he tells us that he recently came across a report that 
might help us to locate transmitting stations. It appeared in a air/spaceflight 
journal, “Flieger Revue", edition 5/1998. A report about transmitting stations 
concerned an accident in October 1997 when an hydrogen balloon crashed close 
to the transmitting station at Nauen. The reason was that current was induced in a 
metal ring holding the balloon - the ring became hot, the cover “melted" away, 
hydrogen escaped and the balloon exploded. The report dealt with the problem of 
pilots receiving information about dangerous transmitting stations, that couid cause 
engine malfunctions. The maps of the ICAO don’t list these transmitters in detail. 
But the Air Force does. So one suggestion is to look into the "Militarisches 
Luftfahrt Handbuch" (Military Aviation Handbook) for "High Intensity Radio 
Transmission Area" (HIRTA). As this literature is NATO standardised, it could 
provide us with some useful information about HF sites, and after sifting out known 
locations, more secret sites may remain. (Used this method long ago with success 
but only in U.K. - Ed.) Hobby pilots are advised to ask local aero clubs or the 
Federal Aviation Bureau (Luftfahrtbundesamt) . The book also contains other 
information about areas of high risk, such as over nuclear reactors, military air 
zones. Do other ENIGMA members have access to this kind of information? 

From Germany back to Britain and Dominic (Cheltenham). He recently joined 
ENIGMA after reading about us in Shortwave Magazine. He recounts an interesting 
story: "About 7 or 8 years ago while searching the 4 & 5MHz region I received a 
female voice reading out a list of numbers in a foreign language. I though it might 
be German, so I taped about 5 minutes of it and let my scout leader, (a GCHQ 
employee) who spoke the language fluently, have a listen. What he said was a bit 
of a surprise to me, "It’s nothing much, just a message for some kind of secret 
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agent working for Germany". He translated the tape and from what I remember it 
contained strings of 5 numbers, these were proceeded by two electronic tones. I 
soon forgot all about it until March 1997. 

! was in Lowe electronics in Bristol buying a new receiver when ! saw a back copy 
of SWM containing a feature on numbers stations. When I looked at the list there 
was one which stood out, The Two Letter Stations (G16,E16). This was the strange 
voice I had heard years ago, and looking at the characteristics they were all the 
same. Lowe kindly photocopied the feature I rushed home to see if I could pick up 
more stations - and I haven’t iooked back since”. (Ed note: Who says GCHQ are 
not helpful!) 

Staying in the Cheltenham area we greet Dave (Shropshire). He congratulates us 
on the details about Merlin communications -1 00% correct, (Lincolnshire Poacher 
article - last issue) however, we did make a mistake with BEMRS. This should be 
British East Mediteranean Reiay Station and not BBC-EMRS. He tell us that the 
authorities on the Island do not like the incorrect version on envelopes - the same 
is true (not mentioned in ENIGMA) of the BBC Eastern relay at Masirah in Oman. 

He also asks what happened to the "U" single letter transmission which operated 

on 6243 kHz during the 1970s and 1980‘s and what became of 

Schulungssender des Qsterreichischen Bundesheeres the Austrian Army Training 
Transmitter which operated on 6221 kHz or 6250 kHz in the 1370s. ...or Turkish 
Police Radio on 6400 kHz? 

He also mentions the use of 6840 kHz (Simon Mason’s column page 39 last 
issue). "November 1980 - are you sure this was a BBC WS Feeder frequency at 
that time? I thought ail the sideband transmitters (1 at Rampisham and 2 at 
Daverrtry) had closed by then. Perhaps others such as British Telecom at Rugby 
etc. or SSVC (Services Sound & Video Corp.) at Chalfont were putting out SSB 
feeders at that time?” (Ed note: Chalfont has no HF, but may have used HF 
transmitters at a BT site). 

Greetings to Michiel who sends us an email from Doom in The Netherlands. 
Regarding part two of the Lincolnshire Poacher article, I would like to add one 
observation to the Mistakes paragraph. Here’s my logbook entry from 20 July 
1994 at 13.17 UTC on 14487. Details: Female speaker with 5-figure groups. 
According to ’Langley Pierce’s book, this is MI6 perhaps via the RAF site at Akrotiri 
(Cyprus). Seems a good assumption: the familiar audio of RAF’s VFT aggregate 
was heard for a while on the background! 

Regarding the REM4 - station, there was a detailed article about it in a voluminous 
utility guide from an Austrian DX organisation, published in the late 1970s or early 
1980s. Unfortunately, this guide did not survive my most recent archive clear-up. 
Anyway, the organisation behind REM4 is called Institute of Applied geophysics 
(IAG) Moscow. I am not aware that the IAG has ever been seen as a covert 
operation of any kind. 

Almost finally, thanks go to Guy (Portsmouth) Rob (Essex) and Andy (Merseyside) 
who each send regular logs and observations. Thank you. 

May we take this opportunity to say thanks to everyone who writes sends 
facsimiles or emails - even postcards! Your contributions are very much 
appreciated. We look forward to hearing from YOU . 



THI NGS THAT GO BUZZ IN THE NIGHT! 

Welcome to another Buzz section. Before we go into a few regulars a couple of 
questions from readers. First, Paul irt Hertfordshire who asks about a signal noted 
across the range between 9920 and 10060 kHz. He describes the signal as an 
'Oriental ' flute playing a tuneless series of three or four notes starting with a longer 
higher one and then playing the three or four note sequence down a scale 
decreasing in pitch. The whole thing then starts again and this apparently continues 
ad infinitum. The signal was noted at 10.10 UTC and was still going at 17.35UTC. At 
first he thought the wide-band effect was down to his receiver and tried a different 
one but still heard the station. The signal is very weak. Has anyone else come across 
'The Continuous Flute" ? 

Our second question is a little easier to answer. Simon in Shropshire asks, what is the 
2 tone bleep on 4420 kHz, a soil of "Doorbell" type of sound? This is Royal 
Navy/Coastal Control Channel D. The transmitters atSt.Eval, also possibly Crimond 
and Inskip etc. 

John asks what the bubbling fizzing sound he hears across SW even/ 16kHz or so? 
This is television line timebase interference which is generated by a nearby television 
receiver and appears every 1 5625 kHz. 

Now some quick mentions to some of the regulars who are still around. 

XC - Crackle From early June noted on new frequency 4426 kHz. Previously resident 
on usual 5500/5505 kHz for a number of years causing interference to Shannon Air 
Radio on 5505 kHz. Try evening time in Europe. 

XM - Backward Music Stati on After commenting on a lack of activity last issue the 
signal seems to have come back to life. Heard in Europe and Australia this signal 
must have wide coverage. Noted at various times between 05.00 & 21.00 UTC - it 
could turn up any time. Frequencies reported: 4376 4410 4420 4740 5! 78 6755 
8123 9035 kHz. Simon in Australia comments "BMS seems to be associated with 
Naval or Marine frequencies". Comments welcome. 

XX - The Pip Alive and well. 05.30 to 14.00 on 5450 and 14.00 to 05.30 on 3757 
kHz. The latter frequency is in a band shared by Amateurs and we have noted 
comments being passed about interference from 'that piping' thing. Would anyone at 
'Intruder Watch' like to comment? The big news on The Pip" comes to us from John 
in Derby. “On April 24th at 22.30 UTC, I tuned into XX The Pip" on 3757 kHz. At 
22.41 UTC the pipping stopped and a male voice made an announcement in what I 
think was a Slavic language, a number of phrases were given with short pauses in 
between. This only lasted two minutes at the most and the piping came back on". This 
sounds very similar to the Buzzer (S28/XB) noted on DEC 24th 1997. Thanks, John 
for that. Readers please keep an ear on this one! 

The Blank Carrier Mentioned last time around, this signal appears on 5305 kHz on 
the hour for exactly 20 minutes. The process repeats each hour. We mentioned that 
it can be heard between 09.00 and 22.00, but recent monitoring at 00.00 UTC 
revealed the signal to be present. Feedback from Mike in Kent who kindly sent the 
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following observations: " 1 tuned in early for a further listen to 5305 as the channel 
was reasonably quiet. There is a "signal" there. The unmodulated carrier came up 
about 500msec before the "hum" started and I had a good recording for a few 
minutes before some flutter set in. More information on this signal is required. 

Another ENIGMA exclusive. 

XF - Faders Chris's favourite hobby horse. A letter from Richard gives us a exclusive 
breakthrough on these signals. He writes. Tve monitored the "Faders" quite a few 
times and have noticed a remarkable resemblance to frequencies that the USAF/US 
Army used in Europe about 5 or 6 years ago for their voice nets "INFORM" & "GANG 
BUSTER". These nets were used to pass EAMs (Emergency Action Messages) to US Air 
Force and Army bases. It used to be extremely active but following the US military 
withdrawals from Europe and consequent base closures the Net went off the air." 

See 'Frequency Match Lisf with this article and let us have your comments. 

Richard writes; "Resulting from my suspicions I decided to investigate further. I packed 
my radio and went along to "RAF" Miidenhail, Suffolk and sat opposite the USAF HF 
transmitters (a small compound) and Faders were transmitting on 9125 and 6875 
kHz, sometimes in parallel and at other times they operated independently. They were 
very busy. When I connected an aerial to my receiver I could hear replies from other 
Faders in the net. Later in the afternoon 6875 was dropped and 5327 kHz came into 
use. Then early evening 5327 dropped, 6875 came back and 9125 went up to 9126 
kHz. Another possible location in the UK would be "RAF" Barford St John." 

'Faders' may be part of the virtually unknown LOCE network, NATO's only secure 
data transmission system. LOCE ~ Linked Operational - Intelligence Centers - 
Europe. The analysis centra is located on a military base at Moles worth. It collates 
and interprets “intelligence from satellites, piloted and pilotless spy planes, electronic 
surveillance and human agents". Comments welcome. 

We gave Faders a mention in the ENIGMA column of the May issue of Shortwave 
Magazine and hope for some further feedback. For all the wonders of modern 
science these unusual signals seem to have evaded the clutches of demodulation! We 
cannot emphasise too much how busy they are. If you have never tried to find them 
then tune in soon! 

This particular mode (see previous issues for description/habits) shows little respect for 
other users and operates across the Fixed Services, Amateur, Aeronautical and 
Shipping bands. We have heard it transmitting on top of a Coastal Station which was 
sending out a warning of floating debris. Recently a Fader was noted blocking out a 
station on 10480 which was sending a radio check under the callsign I4CF. 

$28 (formally XB) - Buzzer 4625 kHz. Our "World Exclusive" Buzzer sends a message 
created a mixed response! Mike in Reading wrote: Re: "Buzzer 4625 kHz This was a 
hoax message you referred to I assume". He adds that the Buzzer does vary its 
transmission. Note that the two-tone buzz which normally appears at 1 minute to the 
hour has been known to appear at other times, and miss the h + 59 'slot'. 

Kai writing from Germany joins in the debate. "In my opinion the destination of this 
frequency cannot be Vienna, as it is simply too low for daytime reception there. 
Already here in Eastern Germany The Buzzer fades in just before sunset. If this is a 
feed to Vienna, they would use a much higher daytime frequency. The selection of the 
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60 metre band 24 hours per day leads me to assume that the intended audience is 
somewhere in the CIS itself: During daylight the range is not much more than about 
1000 km, at night the transmitter suffers no dead zone. With reference to the 
message of Christmas Eve the relationship between St 3/14 and S28 (Buzzer) leads 
me to conclude that this is an alarm transmitter for the Russian Army and that the 
message sent was a test transmission". 

At ENIGMA we have continued to make our own investigations. Despite three letters 
each to the State Frequency Committee and the Radio Communications Authority, 
(both in Moscow) neither agency has had the courtesy to reply. This suggests that the 
official line is to say nothing and hope we will go away! 

Mew information. For reasons of confidentiality several words are removed from the 
following statement 'Thank you very much for your letter of **** . I would like to 
inform you that at our request ******** specialists ran a triangulation on the "Buzzer" 
radio station. I quote from their report: "We have carried out a search/measurement 
together with partners in Germany and Sweden. It seems that the station is sending 
from Russia, in the Moscow region. 

Earlier we asked the Polish communications administration about the 4625.0 kHz 
frequency and never received a reply. I think that the professional HF triangulation 
from ******* r Sweden and Germany are more accurate than the earlier 'Thompson" 
narrow base triangulation made from France. Please allow me to draw your attention 
to the fact that at the end of every hour the "Buzzer" changes its signal and gives a 
steady variable signal tone (most frequently on the 59:00 to 60:00th minute). At this 
time we are preparing to ask the Russian Communications and information 
Committee. When I get more information I will let you know. The available data still 
does not confirm anything completely but I suspect that the "Buzzer" originates from 
the Moscow region and has some military purpose. The next stage of the research 
would require an expedition to the Target Area.' (Thanks to 'A' for this information). 
Our thanks to David (Wales) for the original recording and Vassily (Moscow) for his 
assistance. 

Frequency 4625 kHz - December 25th 1997 - 21 ,58 UTC . 

We can confirm the “Buzzer" does in fact have a callsign. This is UZB-76, this is 
UZ8-76'. The "message" was constructed of numbers and selected words from the 
Russian phonetic alphabet which included; Boris, Roman, Olga, Mikail, Anna, Leonid, 
The initial letter of each word spells "BROMAL". This word does not exist in the 
Russian language. The word BROMAL was spoken and then given phonetically. 

English translation of words spoken are underlined . 

This is UZB-76. This is UZB-76 ". (2 words? Unintelligible - fading). Nul Vosjim (08) 
BROMAL (Spoken as one word). (Unintelligible few words - include figures) "Dvatsat 
-Shest" (26) "Jedinitsa chetjorka nul nul petjorka" ( 14005 ) " Boris Roman Olga Mikail 
Anna Leonid " (spoken as individual words). (Figures!) "Simjorka (?) chetjorka dvoika 
njorka (?) njorka (?) njorka (?) jedinitsa chetjorka (? 42???14) (8 figures) (All repeated 
once). 

Numbers used: jedinitsa (1), dvoika (2), ? (3), chetjorka (4), petjorka (5), ? (6), 
? simjorka (7), vosjim (8), ? (9), nu! (0). Comments welcome. 
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FADERS - FREQUENCY MATCH LIST 



Acknowledgements to Richard. 





2403 A1 




7305 A14 


(F) 13431302 




2452 A2 




7368 ??? 


13479A23 


(F) 


2470 


© 


7384 A15 


13545A24 




3060 R13 




7424 A16 


14374A25 


(F) 


3188 


(F) 


7500 


14423A26 


© 


3215 A3 


(F) 


7658 


14505 A27 


(F) 


3382 


(F) 


7665 


14682 A28 




3688 T01 




7740 A17 


14705L01 




3760 J13 


(F) 


7813 


15476 A29 




3931 BOS 




7919 A18 


1 5560 A30 




3946 A6 


(F) 


7997 


18179A31 




3958 A 7 




8118 T09 


18744 A32 




3973 U06 


(F) 


8185 


20539 A33 




3996 ??? 


© 


91 26 ??? 


20604 A34 


© 


4020 772 


(F) 


9138 


20609 A35 




4035 V07 


© 


9244 BOS 


20349 A36 


(F) 


4062 




9477 A1S 


2031 1 A38 


© 


4458 F10 


© 


10139 A20 




© 


4477 A8 


© 


10478 Til 






4480 P07 


© 


11100 A21 




© 


4496 ??? 


© 


11515 ??? 






4545 S06 




11641 A22 




© 


4560 L02 










4612 A9 










4821 EOS 










4843 










4933 M04 


"INFORM NET' 


prefixed A01 to A38 




4980 ??? 


"GANGBUSTER NET' 


prefixed BOS to V07 




4987 T06 


"UNKNOWN DESIG." 


prefixed ??? 


© 


5092 A10 


FADERS 


(F) 


© 


5105 All 


FADERS UNDERLINED 


(F) Match with 




5146 A12 


frequency used by the above networks. 


(F) 


5195 








© 


5311 A13 


From a total of 38 known Fader frequencies 1 3 


(F) 


5328 


match with the networks detailed above. 


<F) 


5398 


Coincidence? Definitely not! 


(F) 


5468 








(F) 


5787 


Comments welcome. 
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6505 J10 








© 


6796 C03 








6819 A13 








(F) 


6824 








(F) 


6848 








(F) 


6875 
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About this feature. In this and forthcoming issues we will be examining the story of 
SOUD. In part one we will be looking at the background from conception to the 
early 1990s. This will provide the platform to examine SOUD’s radio 
communications in greater detail. In part two we will be concentrating on the 
technical side of operations and detailing SOUD’s activities on Shortwave, its links 
with number stations and its format, traffic, modes and mistakes. In addition we 
hope to bring you up to date on SOUD between the early 1990s and the present 
day. Information has been drawn from a number of sources including translations 
from Stasi files made by Bodo Wegmann & Monika Tantzscher, seized after the 
collapse of the Berlin Wall, and from research conducted by dedicated members 
of Worldwide Utility News and gathered painstakingly over a considerable period 
of time. We are grateful to everyone who provided us with information for this 
feature, particularly Ary in The Netherlands & Andreas in Germany. 



PART ONE 



S.Q.U.D. 

"Sisteme Obyedinenovo Utschotya Danich o protivnike" 

"System for the Unified Registration of Information Concerning the Enemy" 



'The re is no other example of such widespread cooperation between services" 



► INTRODUCTION - "SOUD gathering information about all possible ’enemies’ of 
the alliance" - SOUD is the fascinating story of a secret organisation which was 
born in the very depths of the ’Cold War*. With H.F. links from its headquarters in 
Moscow SOUD built up a database the likes of which had never been assembled 
before. In our feature we will be looking at SOUD from its conception right up to 
the present day, detailing the communications and intelligence gathering efforts of 
a vast organisation. A unique look behind the curtain! 



The early 1970s. The intelligence Services of the Warsaw Treaty Organisation 
(WTO) ■< began bilateral cooperation on the basis of new treaties. With new political 
moves towards the West, the socialist countries became more open towards their 
citizens and there was closer integration between the socialist countries 
themselves. It now became possible to travel from the GDR to Poland or 
Czechoslovakia without a Visa. In addition, there was greater contact and freedom 
between the GDR and the FRG and travel between West Berlin and the FRG and 
vice-versa became easier. Of course, it was not long before the Western 
intelligence services began to take advantage of these new opportunities. Other 
problems began to come to the fore with international terrorism rising, and 
organisations keen to smuggle people from the GDR to the West. 

In 1972 the Olympic games in Munich had seen an attack on the Israeli team by 
Palestinian terrorists. The 1973 Youth World Games were scheduled to take place 
in Berlin and in 1980 the Olympic games were to be held in Moscow. The East 
was keen to avoid any such incidents with the eyes of the whole world watching 
on. 

Cooperation already existed between the KGB and the MfS and agreement had 
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been reached in 1973 on a joint plan to pool information within the socialist 
countries. In 1974 the MfS signed an agreement to cooperate with the Bulgarian 
and Polish services, and in 1977 with the Czechoslovakian StB. Cooperation also 
existed between the MfS and the Hungarian AVH but to a lesser degree. Romania 
was not integrated into the networks of the Eastern intelligence services. 

Ail this was not only intended to cooperate against the Western intelligence 
services, but also to gain a better handle on the activities of opposition movements 
inside the socialist countries who were controlled from Moscow. 

SOUD is born. In the early 1970s what had started has bilateral cooperation had 
moved to the multilateral level. Cuba was to play host to a meeting held in 1 974. 
Havana was to be the birth place of an idea which was to become SOUD. Those 
who attended were later to ’sign- up’ to an organisation which was to fight against 
"ideological diversion". It was not until 1976 that a meeting held in Berlin would set 
out the blueprint. The KGB made a general proposal, which the MfS followed. Only 
the Polish delegation had other ideas - but would sign up regardless. 

"Valeri Kryuchkov from the Soviet delegation said the project should have started 
earlier - and further delay would cause damage to the partners". 

At the meeting held in Berlin it was agreed on the technical terms of reference. 
Agreement was reached between the respective countries and the head of the 
Directorate of Governmental Teleprinter Messages of the KGB. A proposal was 
made from the MfS who requested a direct teleprinter link with HQ in Moscow, and 
an H.F. link for more urgent questions. 

► THE PLAYERS - The seeds had been planted. November 1977 and SOUD 
became a reality - the member states signed the SOUD Treaty. The members of 
SOUD were each allocated a code number when sending or receiving information: 
1 - Czechoslovakia, 2 - GDR, 3 - Poland, 4 - Hungary, 5 - Bulgaria, 6 - Cuba, 7 - 
Mongolia, 8 - USSR, 9 - Vietnam. 

► DEVELOPMENTS - The next step was to begin the process of registration. It 
was planned not only to register persons, but also several other centra! registration 
systems were to be established, including one for the registration of foreigners and 
another about the "objects of operational interest", registration and the delivery of 
espionage tasks and the recording of official political and scientific information was 
also to be included. The development of the database commenced in 1976 at the 
computer centre of the counter intelligence department of the 2nd directorate of 
the KGB. In the mid - 1970s they already had five central (electronic) recording 
systems and it was planned to have one central system with different sub-sytems. 

SOUD was part of the 1st directorate of the KGB, the foreign intelligence service 
known as PGU. The HQ operated their central memory store and was responsible 
for building - up the system, running it, coordination and the registration of the 
inquiries. It was a stand alone department within the 1 st directorate. 
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in 1979, they had 80 employees, 30 of them in software development. The HQ of 
SOUD had three sub-departments: 

1) Management of the system/coordination with other members to further develop 
the system. 

2) Analysing the incoming information/preparation for recording/data entry/ 
answering queries. 

3) Registration of incoming SOUD forms/maintaining archives/micro-filming the 
documents. 

At the outset all employees came from the KGB, it was intended to also employ 
members from other partners. The flow of information from the local service to HQ 
was initially only via the local KGB residence. Later coded teletype lines were 
introduced from the partners to the HQ. 

The development of SOUD moved along in stages. First they buiit up the computer 
system, then the registration of persons. Later they went onto record the 
organisations and institutions of the enemy. The computer system was prepared 
during 1978. From January 1979 until December 1980 the incoming record forms 
from the member services were analysed and prepared for registration. Between 
January 1979 and May 1980 the detailed programming of the computer was 
carried out. From May to September 1980 SOUD tested (during the Moscow - 
Olympics). From September to December 1980 the results of these tests were 
analysed and corrections made. December 1980 and the ’live’ SOUD system was 
up and running. 

The different branches of the intelligence services had to collect the information on 
special forms. These were then passed to a ’bridging section’ who would translate 
the information into Russian, the working language of SOUD. These were then 
sent to the relevant department of SOUD in Moscow and once processed would 
receive a response If Information/answers were subsequently available. 

► WHO WAS THE ENEMY? - This is a most ’enlightening’ look at how the East 
viewed the West particularly during the Cold War years. SOUD issued guidelines 
on its information gathering requirements. Each was allocated a prefix of PK. 

PK - The abbreviation PK is taken from the original Russian text translation 
Personnel Category ( Personkategorie in German). 

PK 1 - Collaborators and agents of enemy intelligence services and persons who 
are suspected to belong to or to have connections with an enemy intelligence 
service. Note: In 1988 Monitors and Inspectors of military activities working on the 
basis of international treaties was also added into PK 1 . 

PK 2 - Leading Collaborators of centres of "political ideological diversion" and 

collaborators of such centres who directly work against the states of the socialist 
community. 



3 °) 



PK 3 - Members of terrorist organisations, individual terrorist, hostage takers, 
aircraft and ship hijackers, "diversant" and persons suspected to be in contact with 
a terrorist organisation or support one. 

PK 4 - Members of Zionist, enemy emigrant - clerical and other organisations. This 
category also includes organisations helping citizens of the socialist countries to 
escape, known as "criminal man-traders" 

PK5 - Persons taking orders from enemy intelligence services, centres of political - 
ideological diversion, Zionist, enemy emigrant - clerical and other organisations 
who were carrying out subversive acts against the socialist countries. 

PK6 - Known provocative agents from the enemy, others suspected to be sent by 
enemy services, foreigners and persons without citizenship with whom in the 
process of cooperation there was no success for an unknown reason. 

PK 7 - Persons offering dis-information on or selling the same material and 

technical models to different states of the socialist community for materia! reasons. 

PK 8 - Persons who carry out provocative actions on the territory of socialist states 
or against their embassy or their citizens in foreign countries. 

PK 9 - Persons who are expelled from socialist countries, or who were not allowed 
to enter one country of the socialist community. 

PK 10 - Persons who committed very dangerous crimes against a state, hide in 
foreign countries and for whom the authorities of SOUD members search. These 
include crimes of high treason, acts of terror and sabotage, endangering of 
international relations and hateful agitation against the state. 

PK 11 - Diplomats and collaborators of embassies and consulates of NATO 
member countries and of Japan, The Peoples’ Republic of China and Thailand who 
are in the countries of the socialist community. 

PK 12 - Correspondents from NATO member countries, Japan, The Peoples’ 
Republic of China and Thailand who are temporarily or permanently resident in the 
socialist countries. 

PK 13 - Collaborators of trade and economic agencies as well as cultural centres 
of NATO members countries, Japan, The Peoples Republic of China and Thailand 
who are officially registered in the countries of the socialist community. 

PK 14 - Members of organisations involved in international smuggling and who 
work against the socialist countries. 

PK 15 - Persons who work to impair the economy of the socialist countries, this 
includes those searching for economic information, those seeking to recruit 
specialists and encouraging them to emigrate and those seeking to lever socialist 



** companies out of work been undertaken in non-socialist countries. 

Note: PK 1 to 10 inclusive were part of the SOUD treaty of 1 977. 

PK 1 1 to 15 were added in October 1985. 

Diplomats and Correspondents from Thailand were registered from 1988 onward 
after a special appeal from Vietnam. 

& SOUD EXPANDS FURTHER - Success was indeed the name of the game and in 
1986 SOUD expanded its vast database to gather information on organisations and 
institutions of interest to the member countries. This was in addition to the work 
already well under way on individuals. 

No country in the Eastern Bloc was better placed (or perhaps quite so 
enthusiastic) than East Germany to gather information. The whole structure of 
control was based on the very ideal of monitoring everything and everyone. The 
MfS had already built up an internal database using its own "connection 
department" which was part of the aptly titled "Central Analysis and Information 
Group" (ZAiG). Officially referred to as ZAIG 4/4 it was not part of the KGB but a 
division of the MfS. ZAIG worked closely with Moscow and members of SOUD, 

The way in which members cooperated with SOUD is revealed in detail in a 
document from 1989 which explains the structure of the MfS - Moscow link. 

Branch 1 (5 employees): decoding and translating answers from Moscow, making 
the process as effective as possible, suggesting improvements and developments. 

Branch 2 (4 employees): giving out answers to questions received from Moscow 
HQ, cross checking data between different users. 

Branch 3 (11, later 13 employees): teletype-connection to the HQ, translation of 
inquiries and other documents into Russian. 

By this point you may be waiting to hear how well the system was working. SOUD 
was capable of recording 300,000 people with an average 1000 bytes of 
information per person 

The number of people registered by SOUD up to the end of 1987 was as follows: 
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1 


102,223 


PK 


2 


12,332 


PK 


3 


13,140 


PK 


4 


9,337 


PK 
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From 1979 to the end of November 1989 the MfS had supplied the details of 
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74,884 people to be registered in the SOLID system. Under PK 1 (of most interest 
to ENIGMA readers) 4,441 suspected members of the FRG-secret service (2,213 of 
the BND, 1,507 Verfassungsschutz, 721 MAD) had made it to the database. A 
further 4,424 American services, 737 of British, 537 of French, 286 of Dutch, 24 of 
Italian, 28 of Finnish, 20 of Iranian, 45 of Iraqi services - and more than 7,000 
where no particular state or service could be confirmed were also included. 

The information in SOUD could be updated and entries could also be deleted. This 
was carried out when men reached the age of 80 and women 75, or when they 
were no longer considered suspicious or had died. The MfS carried out 
widespread checks. If a person was considered suitable for cooperation or was 
perhaps to be used as a messenger he/she was checked through SOUD. The 
same applied for anyone who was from the west who wanted to live in the GDR. 
Inquiries using the database were also carried out on groups of people, 
information on particular topics, the year of birth, place of birth etc. and 
"continuous checks" could also be made on individuals. 

Inquiries could be given various levels of priority. A low priority inquiry would take 
between 5 and 14 days. Urgent inquiries were answered in 24 hours and "flash" 
inquiries 8 hours. There were five modes when answering an enquiry, it was 
possible that the agency that registered the person was informed if another 
agency was later to request it from SOUD. It was also possible that the inquirer 
would not be given the information only the agency who registered it or vice-versa. 
The original provider may have been informed if another service sent new 
information about a person they had originally registered. This was a complex 
system! 

The flow of information was to take place via the post and teletype links of the 
local KGB-affiliate. In the summer of 1983 the ZAiG 4/4 installed a “direct Duplex 
connection" to the HQ in Moscow. Via this line, only "urgent” or "flash" messages 
were sent/answered to/from Moscow. 

Earlier, we mentioned that organisations in addition to individuals were also 
registered in SOUD. The theme of using the PK prefix continued and ran along 
with the existing system. 

PK 1 now included: Enemy Intelligence organisations 
PK 2 now included: Centres of political-ideological diversion 
PK 3 now included: Terrorist organisations 
PK 4 now included: Enemy emigrant organisations 

► MEETING OF THE MINDS - Between March 18th and 20th 1986, SOUD 
members held the first multilateral conference in Moscow. In the MfS archives, only 
the speech of the leader of the MfS-delegation was discovered. In general he 
mentioned examples of how SOUD had helped in the work of the MfS. In general it 
was discussed that the percentage of positive answers from SOUD were low and 
not all the answers of great use. It was also decided that conferences should be 
held every two years, however there were only ever two meetings - events in the 



USSR would later dictate the agenda. 



More information is available about the second meeting. Delegates bordered their 
Tupelovs and headed for Sofia in Bulgaria. The conference was held between May 
16th and 20th 1988. Figures concerning the registration of individuals made over 
previous years was disclosed. (With these kind of figures it was little wonder they 
were so busy). 

The number of persons registered with SOUD each year: 
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The MfS wanted to make SOUD a multilateral control organ with rights. In general, 
it was felt important to standardise the technical equipment of each service - a 
requirement not achieved, and the exchange of information needed improvement. 
An important advantage of SOUD was its ability to cross reference an individual 
who may be a suspect of more than one agency. But operational ability fell below 
expectation. The data in SOUD was often out of date, some members stated that 
perhaps only 25% of information was usable. In 1986 & 1987 SOUD received 
114,000 inquiries, and gave out information about 10,500 individuals. They also 
had more than 1 ,300 topical inquiries. The number of inquiries was rising all the 
time. Other weak points were the form filling and concerns about the protection of 
data. The MfS praised the use of SOUD in the identification of US citizens 
(journalists or embassy personnel) who visited the GDR for short periods of time. 
The MfS also stated that SOUD should be used more to combat internal 
opposition. 

The leader of the Bulgarian delegation announced that they had registered around 
1,700 people in the SOUD system during the previous year. Most of the PK1, 
working for the American, Turkish or Greek service. In 1986/87 they made 5,000 
inquiries and received positive answers to 7.5%. They made 48 topical inquiries 
and received 50% positive answers and information about 1,100 people. 
Information had also been gathered about Western services whose members had 
attended meetings in Bulgaria. 

Vietnam advised that they were to maintain their manual systems of working and 
that they had little knowledge of modern technology. They also requested the 
inclusion of information concerning citizens in Thailand - this was agreed. 

The Cuban delegation confirmed that they were satisfied with the effectiveness of 
the "flash" inquiry system receiving an answer in 24 to 36 hours. Mongolia said 
they had less use for SOUD in their country, as they had little contact with foreign 
countries. 

The next meeting was scheduled for 1990 in Budapest. 
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"BORED & LAZY PEOPLE MEET BABBLERS 1 






♦ INTRODUCTION 

Only in ENIGMA could you get a title like that! In the last issue (1 4) we requested 
information about several stations which could be monitored in the United States. 
One of the successes of ENIGMA has been our ability to untangle stations by 
identifying formats and habits. Operating from England and concentrating on the 
European, Middle Eastern and C.I.S. areas, information about more distant stations 
is often scant. Thanks to our readers in the U.S.A. we are pleased to be able to 
bring you more information about two stations which have eluded the newsletter 
until recently. 

♦V20THE BORED PEOPLE 

The first is new designation V20. This station will now be named The Bored 
People (incorporating the other descriptions sometimes used of Lazy Man). V20 is 
actually referred to more commonly as the "Bored Man" in the United States, not 
Lazy Man, due to the monotonous nature of the transmission format and resulting 
tendency of the announcer to yawn during broadcasts. In winter the schedule 
reported is SUN at 15.00 UTC & WED at 21.00 UTC on 6868 kHz and on MON at 
20.00 UTC on 6892 kHz. In summer it appears one hour earlier than UTC when 
Cuba is on summer time and has been noted at 14.00 UTC on SUN on 5135 kHz. 
Test’s have also been heard on 41 06 kHz. V20 appears to operate a low power 
transmitter, which accounts for it not being widely heard. The technical aptitude is 
also somewhat lacking; maybe explaining why the station sometimes skips 
broadcasts. The Bored Man does periodically put out a clean signal. However, this 
is the exception, rather than the rule. 

The format of V20 is as follows: On the hour, a live Male or Female (Bored 
Woman!?) announcer will repeat the following for approximately thirty minutes... 
"Atencion, Atencion, Atencion; Ere Dos Noventa; Un, Dos, Tre, Cuatro, Cinco, Sies, 
Siete, Ocho, Nueve, Diez". On one occasion the operators counted from one to 
twenty. This may or may not be significant to the message. The announcer will 
often change during the broadcast. Note: last 2 figures are not read out as 
separate digits, and letters are not read phonetically but by their Spanish names. 

The message is, "Ere Dos Noventa” (R290). The R290 message is sent 90% of the 
time. Also noted are "X301'', "X321", 'X375” and most recently “C791". The entire 
transmission follows this simple format (on some occasions salsa or classical 
music is played between counts) and ends abruptly after 30 minutes with “final 
final”. 

Some reports suggest a pause between the first and second digit creating a 
"C7-91 " message. 
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Two schools of thought exist as to the possible agency behind this transmission. 
The first indicates that the station may be operated by anti-Castro groups or 
guerilla forces from inside Cuba. Ed note: Unlikely as Cuban authorities would 
have found it before now. If anti-Cuban must come from outside Cuba, maybe 
Florida. On most occasions, there is a lot of conversation and laughter going on 
in the background. Once last summer, however, the announcer sounded like he 
was in stark terror. He was literally yelling the message, and was talking so fast 
that he was tongue-tied after just a few minutes. You could ’feel’ the fear in his 
voice. Ed note: If live and under threat why risk such long transmissions - after ail, 
long messages are not being sent? 

The second school of thought points to links with official Cuban Forces. If you 
listen carefully, you can hear Morse code going on in the background "studio" 
noise during some transmissions: this has been paralleled to CW nets on 5258 
and 5485 kHz which appear to be run by the Cuban army and are audibie in the 
Southern United States. Ed note: Alternatively, they may not be Cuban at all - there 
is no evidence to say they are. Could be any Latin American country. 

Although evidence is lacking it may be possible that another station listed by 
ENIGMA -VI 9 may be a relation. A recording of a Spanish Male accompanied by 
the music ’Don’t Cry For Me Argentina’ and callsign WTR21 was noted in the 
mid-1980s by Christain, a biind listener from Germany. (This recording can be 
found on the Conet project CD). Like certain other stations it was only heard on 
one occasion so the recording is particularly valuable. The tune was played three 
times and the message commenced with the caiisign WTR21 (the range WAA to 
WZZ are allocated to the U.S.A.). The message was of a peculiar format the first 
three digits e.g. 431 were announced - ’four hundred and thirty one’ followed by 
two digits 32 - announced ’thirty two’ but in Spanish. This was followed by a short 
break and the whole message was repeated but this time as the more familiar 
single numbers. The transmission ended ’fin’ and the cal! VYTR21 was again 
repeated. 

*V21 THE BABBLER 

From Bored People to Babblers and another new designation V21 . Some doubts 
have been raised as to whether this really is a numbers station - but we will give it 
the benefit of the doubt until evidence is more conclusive. Other reports indicate 
that it may be associated with the above listed V20 - more on that later. 

The Babbler has it origins back in the 1970s. The message consists of a Spanish 
man or woman, live transmission, chanting or singing a repeating string of 
numerical groups which are usually 2 or 3 digits per group: the "long " form of the 
groups is read, i.e. "145" will be read "Ciento Cuarenta y Cinco" rather than 
individual digits. The same string is read repeatedly, with individual group values 
varying somewhat, suggesting something similar to "voice telemetry" being sent 
rather than encrypted text messages. According to some retired SIGINT 
professionals, this is the format used by former Soviet Air Defence CW nets for 
target tracking information; so, this could be a similar operation by the Cuban 
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DAAFAR (Anti-Aircraft Defence and Revolutionary Air Force). This would make it a 
primitive analogue to the NATO "Alligator" Link systems. 

Lots of “long count" tests are conducted. Frequencies are changed infrequently but 
inevitably. The primary frequency in recent months has been 5688 kHz, but since 
January 1 998, 5637 kHz has become more active. Others noted include 5643 kHz 
and 5341 kHz which is still in use primarily for test purposes. The frequencies are 
rather random, but particular frequencies are usually active for a month at a time, 
and then gradually replaced by another, with a period of both frequencies being 
active. 

Each frequency appears to employ different transmitter sites from day to day, as 
audio quality and signal strength vary wildly; either AM or SSB may be used on 
any given frequency. Transmitters are fed by land-line circuits, lots of hum, dialling, 
and crackling may be heard at times. Operation is sporadic; local Cuban mornings 
are the most active periods, but traffic may be heard at any time during day or 
night. Sometimes other Cuban voice communications are heard on the same 
channels; this is the case with both 5688 and 5637 kHz. Up to four channels have 
been noted active simultaneously with independent content, but one or sometimes 
two is more typical. Occasionally, tests on multiple frequencies, including some 
new and some long-dormant ones, will be heard during the last week of the 
month, but this doesn’t appear to happen monthly. The lowest frequency noted 
was 3040 kHz, the highest was 8090 kHz, with most between 4 and 7 MHz. 

Speculation about the transmissions varies with reports that V20 and The Babbler 
are related. Reports indicate that a V20 transmission was heard in the background 
of a Babbler transmission. Digital data has also reported being sent by The 
Babbler. 

During the early 1980s, at least one Babbler station was possibly a "black" 
operated by the American side. The station was on 3646 kHz at night time (in USA) 
for several months, utilising the usual format. One night, some audio from a Key 
West, Florida FM station found its way into the transmitter and was relayed for 
several hours in the background. The following night the station made a big show 
of relaying the Russian "Mayak" programme at full modulation from Havana. Draw 
your own conclusions from that one. 

At present this is all the information we have on these stations. We are always 
pleased to receive more information and comments. 

Our thanks go to readers in the United States, Chris, John and a reader who 
wishes to remain nameless for providing the information and cassette recordings 
which made this feature possible. 

Chris ends: "Sorry these stations don’t fit into the nice rigid formats that many 
European numbers stations do". 
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LOOKING BACK with , D > 



Czech Mate - The Case of Erwin van Haarlem 

On the evening of 2 April 1988, Special Branch detectives raided a third floor flat at 
35 Silver Birch Court, Friern Barnet, North London. Inside they found Mr Erwin van 
Haarlem a 42 year old "Dutch" art dealer receiving a coded CW message on a 
shortwave receiver. This was the end of one of the strangest spy cases in recent 
years and followed months of surveillance by MI5 on his home and daily 
movements. 

The story started in 1944 when Mrs Joanna van Haarlem had a liaison with a 
German soldier in occupied Holland^ and the product was a child later christened 
Erwin. The father died in the battle of Caen, and the mother was shunned by her 
family due to her relationship with the German, and the fact that she was Jewish. 
Unable to look after the child, she left him with the Red cross in Prague who said 
that they would find him foster parents. She had no further contact with the child. 

in May 1975 a man calling himself Erwin van Haarlem arrived in Britain on a Dutch 
passport to work at the Hilton hotel in Kensington. He was in fact an illegal 
undercover agent employed by either the Czech intelligence (StB) or Czech 
military intelligence (SFGF) to spy in Britain. 

ft appears that he was sent to Britain to spy on Jewish dissident groups and 
collect information on companies participating in the "Star Wars" programme. The 

true nature of his work, though, may never be know as MI5 admitted at his trial 
that they did not know what he was doing in the UK for 1 3 years, and indeed did 
not know who he really was. It appeared that a high quality illegal agent would not 
be solely used for this sort of open source collection duty and perhaps was a 
"sleeper", an illegal who would be activated in wartime. His cover was nearly blown 
in 1977 when the mother of the real van Haariem came looking for him, and for a 
number of years she believed that this man was her son as he gave her 
heart-breaking stories about his early life. A DNA test following his arrest revealed 
that there was only a 1 : 18,000 chance that he was her son. The fate of the real 
van Haariem is unknown. One report said that he had died as a child in Prague. 

Erwin continued working at the Hilton as the purchasing manager until 1985 when 
he set himself up as an art dealer specialising in miniatures. This presumably 
would give him more time to deal with his real job as he was self-employed and 
could spend much time travelling and working from home. It also meant that he 
could run his routines around his radio broadcasts. Nobody in the art world had 
heard of him. He also had thousands of pounds of unexplained income, £54,000 
having been paid into TO bank and building society accounts. In 2 years he 
deposited over £17,000 in his accounts, and an accountant found that pictures he 
said he had sold were still in his possession. The business was just a "front" to 
conceal his real activities, and he produced bogus paperwork to make it look as 
though the business was running normally. 
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People who knew him described him as a "pleasant oddball", and the landlord of 
his flat in Alderney Street, Westminster noticed that he changed the locks to the 
doors and kept the keys to himself. In Friern Barnet, the neighbours noticed that 
he did not have visitors and rarely spoke to anyone. He was very interested in 
Jewish affairs and pretended to be Jewish, even twice visiting Russia with a protest 
group, as he could speak Russian. He spoke English with a mid-European accent. 
He visited the US to obtain information on Jewish affairs and on the National Task 
Force, as well as making 3 trips to Austria. 

It appears that Erwin was Czech and had probably joined the StB after military 
service. He was then trained for 3 years before being sent to Austria and then to 
England, in Austria he was engaged on "orientation” duties to adapt to the West 
before moving to the target country. He worked first as a waiter and then attended 
a catering college to build his cover. 

"Mr Erwin van Haarlem aged 43, is accused of a breach of 
section seven of the 1920 Official Secrets Act by doing an act 
preparatory to the commission of an offence under the 1911 
Official Secrets act on April 2. He is accused of recording 
enciphered information and being in possession of equipment to 
decipher that information for the benefit of a foreign power". 

"They arrive covertly with someone else's identity. They have 
no past intelligence background and have never been posted to 
an embassy in the West. MIS has no way of knowing who the 
illegals are unless they make a mistake or are caught 
electronically - trapped by the sophisticated "ears" of GCHQ. 
Through its listening centres GCHQ had detected incoming high 
frequency Morse code signals from the Prague area for a long 
time. It was stated in court that van Haarlem was known to 
have received 200 coded signals in 13 years” . 

Little about his activities was revealed at his trial, but it is known that he was 
controlled by numbers in the form of Morse code sent from Prague. His radio was 
a popular SW receiver and was manually tuned. In 15 years he received 200 CW 
messages in 5 figure groups. These were decoded using one time pads. Three 
unused pads were found hidden in bars of soap which had been hollowed out. 
Three other one time pads were found hidden in his flat. It was one of these 
messages he was receiving when he was arrested, and several messages were 
read out in court. All the others remained impregnable. The messages read, 
"Prepare your report for hand over in Vienna, repeat Vienna. Indicate how you use 
the microfile". "Regarding immigration , use your initiative". A second message read 
“Send only news about intended actions against the Czech Socialist Republic". 
Magazines in the flat contained addresses in Czechoslovakia, and there were 
chemicals for writing secret messages. In a wallet was a slip of paper which 
contained lists of coded dead-letter-boxes for leaving information. One which was 
code-named "Marx" was at the "Minstrel Boy" public house in Colney Hatch in a 
broken wall. Another was by a line of poplar trees on the edge of a golf-course. 
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Further information was found on how to obtain British nationality, Social Security 
help and birth certificates. It appeared that the only contact he would have with 
the Czech Embassy was via the illegal*’ support officer, but everyone in the 
Embassy denied all knowledge of him. Upon his arrest he asked the police to 
inform the Czech Embassy that he had been arrested. 

"A spokesman for the Czech embassy yesterday continued to deny 
having heard of him” . 

How he was caught was not revealed but it is believed that a Czech defector gave 
him away, and his second trip to Russia had drawn the attention of immigration 
and Special Branch. A surveillance operation was mounted, lasting many months . 
Finally, when MIS realised it had found its man, it launched an even bigger 
operation to gather evidence against him. A flat overlooking the back of his 
address was taken over by MIS in August 1987. They used binoculars, probe 
microphones and telephoto lens cameras to watch him. His phone was tapped and 
his flat bugged as well as him being followed constantly. 

"Neighbours spoke of a mystery team of people who moved in to 
a flat overlooking van Haarlem's. The men were seen carrying 
electronic equipment. Then, two days before the swoop, a 
suspicious builder's van stayed parked outside the Czech's 
flat” . 

The team in the flat consisted of four men and a woman who so alarmed 

neighbours that they informed Special Branch! A strange loop aerial had been put 
up and people said they saw lots of equipment in the flat as well as dense net 
curtains. They made lots of noise and spent much time moving heavy equipment 
around. The battery operated clocks in peoples’ flats either stopped or went fast. 
People also found interference on their televisions with dots and dashes on the 
sound. Van Haarlem refused to tel! investigators what information he had 
transmitted by Morse code to his "control" in Prague from his flat. 

"Mrs Saint, 61 who coordinated the Neighbourhood Watch Scheme 
said she and her daughter had telephoned the police in 
November but were dismissed as nosey neighbours. She said that 
shortly after they moved in she heard strange noises and was 
perplexed by the "Morse code” interference which affected her 
TV set every night at 9.20. Mrs Saint's curiosity grew after 
she spotted her mysterious neighbours (MI5/Special Branch) 
carrying what looked like a box of electronic equipment into 
the flat. At first she thought it might be a computer but 
began to have her doubts when each night she noticed the 
strange TV interference” . 

She added: "At one time there was a lot of banging about and 
when I went to complain they seemed very anxious to know 
whether we had been able to hear what they had been saying. 



"The man who answered the door claimed it was being used by 
his engineering company as a temporary office. “When I replied 
I knew something about that because my father had been a 
bridge builder, he gulped and became very flustered. There 
were other odd things too. For example, every morning at 6 A.M. 
their telephone would ring and this was answered immediately. 
"At Christmas, I went to the flat and asked if they would like 
to join us for a drink. The man who answered the door, peeking 
through a crack, thanked me but never turned up.” 

Three weeks after his arrest, the surveillance team moved out. 



The authorities could not prove what he had passed on to his bosses or even that 
he passed any information on at all. What he was convicted of was the possession 
of the means to receive and transmit ^secret information and this earned him a ten 
year sentence in Parkhurst prison. He only served a fraction of his sentence as he 
was deported in 1992, probably due to the good relations now existing between 

the UK and Czechoslovakia. Perhaps he sent Mi5 a postcard Any 

additional information about Erwin van Haarlem past or present would be 
appreciated. 



Acknowledgments: Rob Evans for providing newspaper reports. 
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M23 - The "ODD-EVEN STATION” (Part 1) 



At last we have got round to featuring M23, a major numbers station without a 
family, and with some very peculiar habits. Not for nothing is it also known as the 
Chameleon station, for it has a bewildering variety of format variants. NO OTHER 
STATION OPERATES IN THIS WAY. 

Transmissions are all in ICW, and use a quite distinctive 'staccato’ auto-keying, where 
the relative lengths of dots, dashes and spaces aren’t quite like those of other stations. 
A long zero is used, giving a clue to origin. The only other major stations using long 
zeroes are M4 (Swedish Rhapsody) and the now defunct M2 - NNN’s busier morse 
'arm’. 

Basic Format 

Very loosely, we can say that there is a 'primary’ format, which occurs slightly more 
regularly than the others. Formats can vary to such an extent that the only thing two 
transmissions may have in common is the 'core’text, and its repeat sequence. Calls 
and endings can vary considerably. This 'core’ text element, the message, consists of 
single 5f groups, of which some are not random. Usually, but not always, the first 
group is identical to the last (both included in GC) and usually this contains at least 
one zero, generally in the fourth place. The penultimate group is also significant in 
that it usually has zeroes in its last three or four places, and has even been 00000. 
These non-random groups clearly play no part in the message itself, and probably 
contain decryption instructions, the DK being part of the first/last group. (We’ll have 
more to say on this later). Group counts tend to be in the medium range, averaging 
around 40. 

This 'primary’ format is one of the odd/even formats, where the lQmin cal! is made 
up of a 3f schedule number which also serves as a null message indicator. Generally, 
3 odd figures, e.g. 391, indicate that no message will follow, in which case the call cuts 
off abruptly after 10 minutes. However, when a message is to be sent, the call 
changes to three even numbers, e.g. 486. After 10 minutes, a pause is followed by = 
= (GC repeated once) = = (message follows) ==??== (GC, again sent twice) 
= = (repeat of message) = = AR AR. 

We’ll cover numerous variants in Part 2. 

Scheduling 

Scheduling is as varied as formats. Again, we’ll only discuss here the 'primary’ 
scheduling pattern, which is a little more frequent that the others. Two parallel 
frequencies are used, often chosen from a favoured selection. Parallels aren’t 
consistent - one freq may share with several others at different times. 



This tendency to use 'favoured’ freqs. helps towards identification, seeing that 
formats cannot be entirely relied upon. 



'Primary’ schedules keep the same schedule numbers (odd or even depending on 
status) throughout their lives - (many other schedules do not). They operate daily or 
twice daily, usually on the hour, occasionally on the half-hour. Timing is hardly a 
strong point - transmissions may begin anywhere between h-3 to h+5min. Messages 
on these 'primary’ schedules come under the rare/occasional/never category. i.e. the 
vast majority of calls use odd numbers. These schedules have lives which may vary 
from a few days to a year or more. The longest-running schedule we know of is still 
with us, having begun in February 1997: ID 579, 0800 & 1400 on 8307//9285. No 
messages have yet been sent. It is possible that some of these schedules never send 
messages, and act as some kind of daily status indicator. None of the schedules, 
primary or otherwise, have been found to follow any kind of cycle - never 
reappearing, say, a year later. Few stations behave in this way. This implies that they 
all relate to specific 'missions’, which don’t coincide with regular 'tours of duty’. 

Frequencies noted so far: 3380 4630 4767 4800 4825 4893 5019 5080 5180 5349 5400 
5540 5625 5665 6290 6520 6560 6870 6918 6999 7504 7520 7795 7830 7850 8307 9285 
10200 10775 11346 

Those underlined have been in use for many years. Possibly they all have, maybe 
some having years of intervening inactivity between one schedule and another. 

Signals are usually strong in Europe, and transmitter faults and errors (apart from 
late/early starts), are unknown. In the next part we will attempt to cover the many 
variants of this station, and some of its wierder scheduling patterns. 



239 - 03607 57063 56355 31143 15660 18963 22567 86865 87334 05913 

87499 50150 78340 72725 44423 63534 11748 25049 38868 97579 

15265 03634 63049 27566 98613 00863 57480 16911 81807 15975 

42616 60160 88723 65791 77295 38561 90542 64836 99462 13181 

09873 45062 85492 59527 86391 33731 86935 05040 70316 38267 

88689 96217 77845 26260 57285 45618 99392 44631 78328 94949 

95637 23174 81050 78351 78888 41482 51724 89002 54738 14141 

70572 56529 28403 75830 17399 26227 95744 12368 55734 36289 

40403 18272 67831 54724 98562 06826 77381 84531 09573 90600 

60327 49408 37148 60078 87994 25501 01549 92062 54774 64940= 

718 - 8/621 9/984 10/029 11/115 12/232 1/677 

111/6 111/7 

"PAR CE SIGNE TU le VAINCRAS" nous disons... 




J - 111/ 27/2 
DZ - 111 13/3 
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NEWS ROUND UP - REPORTS OF INTEREST 



► RUSSIA - FOREIGN SPIES ACTIVE IN St PETERSBURG - The results of the 
work of the Federal Security Service (FSS), in the opinion of the head of the 
directorate of the FSS for the St Petersburg and Leningrad Region, Viktor 
Cherkesov, "shows that foreign intelligence services are active in our country and that 
Russian special services have the opportunities, capabilities and means to combat 
them". The FSS had discovered and unmasked 29 agents of foreign intelligence 
services, which is in line with the postwar level. 

One inhabitant of St Petersburg was found guilty in 1997 of treason and working for a 
foreign intelligence service with a system of tasks and proven acts of passing 
information. One other case of a Russian citizen cooperating with a foreign 
intelligence service came to light with the help of the local FSS directorate’s 
confidential telephone line (278-69-93), which has received 400 calls in the past four 
months of its work. Every one of these calls resulted in the necessary consultation or 
check. A ’’resident agent” made a call on the confidential telephone line which made 
it easier for him to escape from the tutelage of his foreign recruiters. 

► LITHUANIA - IN TELLIGENCE CHIEF CALLS FOR BETTER FUNDING - The 
head of the Lithuanian State Security Department, Jurgis Jurgelis, has called for 
better funding for his service. In an interview in the ’Lietuvos Rytas’ newspaper, 
Jurgelis said that counter-intelligence, security and analysis sections need to be 
expanded in particular. Fie admitted that the formation of an investigations service in 
the Ministry of Internal Affairs had weakened his department. Some divisions had 
lost many of their staff, including badly needed computer experts. Jurgelis said that 
the department had had successes in countering foreign agents in Lithuania and in 
conducting intelligence work abroad. The service claims to have detected safe houses 
(of intelligence agents) from several countries. Foreign spies in Lithuania are 
employing their usual cover: diplomatic, commercial and media. The exact number of 
staff employed by the service cannot be disclosed but they are now employing more 
women in the service. It was also stated that ihe Lithuanian intelligence service 
conducts activities abroad. We gather information about the political, economic and 
military situation in neighbouring countries. We pay special attention to the analysis 
and assessment of outside threats to Lithuania. We get a great deal of information 
from analysing the press, as well as the radio and TV broadcasts of those countries. 

► POLAND - RUSSIA REJECTS SPY ALLEGATIONS AGAINST DIPLOMATS IN 
P OLAND - A report in the Warsaw Daily Newspaper ? Zycie ? claims that a list of 23 
Russians who - according to anonymous informers were or are Russian intelligence 
agents. The majority of the Russians on the list have left Poland, but four remain. 
The brain behind the ring was the Russian ambassador in Poland, Yuriy Kashlev, who 
already ended his mission to Warsaw. The newspaper thinks that the Polish 
counter-intelligence service is helpless in the case: the Russians have technical 
resources many times in excess of those of the State Protection Office. The head of 
the press service of the Russian Foreign Intelligence Service Gen. Yuriy Kobaladze 
calls the revelations by ? Zycie’ ridiculous and untrue. He did, however add ”we are 
indeed interested in your country but our agents are not doing anything in Poland 
that Polish intelligence would not do in Russia". 



► BELARUS - SECURITY CHIEF CONCERNED OVER POLAND'S ALLEGED 
INCREASE IN SPY ACTIVITIES - Minsk. "The Polish special services have started 
mass recruitment activities among Belarusian citizens," Chairman of the State Security 
Committee (KGB) Uladzimir Matskevich stated. He also said he was concerned that 
"an increase in this activity is under way". A larger number of Belarusians have turned 
to the KGB for assistance, he said. These facts testify "to a certain policy (pursued by 
Poland) at state level", he said. This activity by the Polish special services cannot 
continue forever and assume a scale threatening the national security of Belarus. 

► BRITAIN - PLANS FOR BRITISH EMBASSY IN UKRAINE ABANDONED - Plans 
for the new British Embassy in Kiev had to be abandoned after the Ukrainians had 
asked HM Government not to go ahead. Reports indicate that the neighbour of the 
embassy would be no other than the Ukraine President, Leonid Kuchma. According 
to the Ukrainian Newspaper "British Diplomats might not be able to resist the 
temptation to listen to every word the president and his family said". 

Our contributor says - I for one cannot think of anything so 
ungentlemanly as to eavesdrop on someone else conversation! 

► BRITAIN - MUSEUM OF SECRETS AT DEFENCE INTELLIGENCE CENTRE - 
Recent revelations about Britain’s best kept secret museum have recently come to 
light. It is located at the classified Defence Intelligence & Security Centre at 
Chieksands, Bedfordshire. The museum does not advertise itself. Its telephone 
number is not listed, nor available from Directory Enquiries. Local tourist information 
does not include its details. The museum is devoted to field intelligence, surveillance, 
observation, map-making and sketching, and from modem times, the interpretation of 
aerial photography. 

The first of its two rooms traces the history of the Intelligence Corps from Henry 
VIII, who created the post of Scout-master ’to search and view' that there be no 
enemies laid privily for annoyance’. The second room is rather more dramatic and 
houses the private Medmenham collection of aerial photographic intelligence 
materials. There are models of D-Day beaches, an exhibition of Operation Bodyline 
(which targeted the VI and V2 rocket bases), a giant air camera, and modem light 
tables used to create minute accurate imagining from aeriai photographs. 

The museum has been asked to contribute to Bedfordshire’s Millennium celebrations, 
but is unlikely to be a serious competitor to the Millennium Dome, although its 
contents may well offer more education. 

The Defence Intelligence & Security Centre at Chieksands was formally known as 
RAF Chieksands - a cover name for the base which was part of the United States 
NSA operations in Europe. The base used to be home to a huge Wullenweber 
direction finding antenna (AN-FLR/9) which is now dismantled and the site now 
houses the new Special Wireless Section. Also of interest is a new shooting range, and 
a Psyops section, moved from MI6’s training centre at Ashford, and expanded. The 
base is now home to the DIS which has two main parts, the Defence Intelligence 
Analysis Staff (DIAS) in Whitehall, and the Intelligence and Geographic Resources 



Staff (IGRS), which has a headquarters element collocated with the DIAS, but the 
bulk of whose staff work in three DIS Agencies outside London. 

These are the Defence Intelligence and Security Centre (DISC) based at Chicksands 
in Bedfordshire, the Joint Air Reconnaissance Intelligence Centre (JARIC) at 
Brampton, Cambridgeshire, and the Military Survey mainly based at Feltham 
Middlesex. The purpose of DIAS is to carry out All-Source Assesment using 
information gathered both in an overt or covert manner and to provide information to 
the MOD Ministers and Central Staffs, operational commands, the Permanent Joint 
Headquarters, NATO and other government departments. 

If you are interested in visiting the museum do not simply turn up, but book your visit 
by telephoning UK 01462 - 752340, mentioning ENIGMA may not improve your 
chances of obtaining a pass! 

► CHINA - CHINESE SATKTJ.ITE SUFFERS JAMMING A mysterious signal 
hitting a Chinese telecommunications satellite is disrupting share trading, earthquake 
monitoring systems, and pager services in China. Technicians had ruled out a problem 
with the Apstar-1 orbiter which had "suddenly received a signal of neutralizing 
interference from an unknown outside source," investigators had not ruled out that 
the Earth based interference was the result of an attack by domestic or foreign 
saboteurs. The disruption reportedly affected more than 400 securities and futures 
companies and 100 paging services, cutting off services to more than 10 million pager 
users. The use of satellites present their own series of problems and many countries 
maintain back-up HF systems (some like HEP and the large French network 
FDY/FDC etc. are still heard reserving channels, while other HF transmitters and 
feeders are moth-balled. Several recent events have again high-lighted the 
vulnerability of space communications. The United States are testing a laser beam 
which can be fired from earth simply blasting foreign intelligence satellites into 
oblivion. Recent TV reports indicate a test firing at an ’old’ communications satellite. 
A gleeful US official described the system as capable of destroying something the size 
of a refrigerator from an Earth using the laser beam. 

► BRITAIN - RAF TESTS jamming TRANSMITTER - A report carried on BBC 
Radio 2 news (and dropped from later bulletins) indicated that the RAF were 
conducting tests to deliberately jam the Global Positioning Satellite System (this 
allows any user to determine their position very accurately anywhere on the planet 
using only hand held domestic equipment). The report indicated that the system 
would be jammed in the event of (unspecified) conflict. During WWII Britain 
removed all its road signs in the event of an invasion, with a view to slowing down the 
enemy. Any attempts by enemy agents to travel around the UK now would surely be 
severely hampered by road works if they did eventually get off the M25! 

► BRITAIN - ASCENSION ISLAND HOME TO ELECTRONIC SPIES Until 1982 
virtually no one in Britain had ever heard of the Falkland Islands. Until then, Prime 
Minister Margaret Thatcher launched a mini-war to recover them from invasion by 
Argentina. Today fewer still will have heard of Ascension Island, a lump of volcanic 
rock situated 1,600 miles from Nigeria and 1,500 miles from Brazil in the middle of 
the Atlantic ocean. The location of Ascension and its unique administration makes it 
ideal for secret activities. There are no native people of Ascension at all. The island is 
a British possession and access is strictly controlled; passing yachtsmen have to obtain 
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permission to spend a night on the Island. The RAF are present and the Americans 
on the Island manage the huge airfield they built 50 years ago. The Island is home to 
the relay transmitters of the BBC World Service (operated by Foreign Office 
employees). Once the broadcasters had proven the value and isolation of Ascension, 
the electronic spies turned up, too. The Island they found, was a static free, people 
free listening post from which they could eavesdrop on every telephone call and radio 
message being conducted in Africa. A huge and deeply secret intercept station was 
built. According to recent reports it is "an Island crammed and jammed with fizzing 
aerials and humming radar domes and nodding scanners and blinking lights, with 
machinery that is working ceaselessly tor spies." Sounds like the ideal Numbers 
Station location. 

► LUXEMBOURG - EUROPEAN PARLIAMENT DISCUSS "ECHELON " - A recent 
report confirms for the first time the existence of the secretive ECHELON system, 
confirming that the citizens of Britain and other European states are subject to an 
intensity of surveillance far in excess of that imagined by most parliaments. The 
report - Assessing the Technologies of Political Control was commissioned by the 
Civil Liberties Committee of the European Pariiament. It contains details of a 
network of American - controlled intelligence stations on British soil and around the 
world, that "routinely and indiscriminately" monitor countless phone, facsimile and 
email messages. It states: "Within Europe all email telephone and facsimile 
communications are routinely intercepted by the U.S.A. National Security Agency 
transferring all target information from the European mainland via the strategic hub 
of London then via satellite to Fort Meade in Maryland via the crucial hub at 
Menwith Hill in North Yorkshire". The report confirms for the first time the existence 
of the ECHELON system. Until now, evidence of such astounding technology has 
been patchy and anecdotal. ECHELON is designed primarily for non-military targets: 
governments, organisations and businesses in virtually every country. The system 
works by indiscriminately intercepting very large quantities of communications and 
then siphoning out what is valuable using artificial intelligence aids like MEMEX to 
find key words. Claims have also been made that ECHELON automatically analyses 
most email messages for "precursor" data which assists intelligence agencies to 
determine targets. According to former Canadian Security Establishment agent Mike 
Frost, a voice recognition system called Oratory has been used for some years to 
intercept diplomatic calls. 

One of the NSA’s bases, Menwith Hill, is the biggest spy station in the world. Its ears 
- known as radomes - are capable of listening to vast chunks of the communications 
spectrum throughout Europe and the former Soviet Union, in the first decade the 
base sucked in data from cables and microwave links running through a nearby Post 
Office tower, but the communications revolution of the Seventies and Eighties gave 
the base a capability that even its architects could scarcely have been able to imagine. 
With the creation of Intelsat and digital telecommunications, Menwith and other 
stations developed the capability to eavesdrop on an extensive scale on facsimile, telex 
and voice messages. Then, with the development of the Internet, electronic mail and 
electronic commerce, the listening posts were able to increase their monitoring 
capability to eavesdrop on an unprecedented spectrum of personal and business 
communication. This activity has been all but ignored by the UK Parliament. When 
Labour MP’s raised questions about the activities of the NSA, the Government 
evoked secrecy rules. It has been the same for some 40 years. 
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► ISRAE L - THB BRIGHT SIDE OF FOOT, UPS - Mossad has been big news 
recently. At least one (four were implicated) Mossad agent was recently arrested in 
Switzerland in a bugging operation which went awry. Last year Mossad agents 
operating in Jordan injected Khaled Mishal an Hamas leader with poisonous 
chemicals and only intervention by King Hussein forced Israel to supply an antidote 
to save Mishal’s life. The attempt on Mishal’s life failed when, instead of spraying the 
toxin into his ear, from where it should have travelled to his brain, causing 
haemorrhage and death, within six to eighteen hours, the poison struck his neck and 
collar. If things could not get worse Mossad agent Yehuda Gil was arrested after it 
was revealed he had supplied false intelligence reports, the results of which could 
have been almost sufficient to start a war between Israel and Syria. The combined 
effect has been the resignation of Mossad head Danny Yatom. 

Problems at Mossad go back many years. In 1991 four Israelis were arrested during 
an attempt to bug the Iranian embassy in Nicosia in the dead of night. The four, 
widely reported to be Mossad agents, claimed they had been looking for a lavatory. 
They were released on payment of $1,000 fines. Norway is also requesting that they 
be allowed to interrogate a former Mossad agent over his role in the assassination of 
Ahmad Bushiki, a waiter holding a Moroccan passport. Bushiki was mistaken for FLO 
security officer Ali Hassan Salameh. In 1993 Mossad admitted, "We never spared any 
effort to spot the real target but Salameh and Bushiki were so identical that one 
would think they were twins". 

Scarred, tattered and temporarily headless, it would seem the once vaunted and 
mysterious Mossad is heading for the doghouse - exactly where spy agencies go when 
they don’t shoot straight, fabricate intelligence reports and can’t even tap a phone 
without getting caught. In a country where people are drawn to elite units, it appears 
the Mossad will have to make some drastic moves to invigorate its ranks and pull the 
best of Israeli youth into an organisation whose successes are shrouded in fog and 
whose failures are fodder for the media. Or does it? 

Experts and former Mossad officials say that exposure, even bad exposure, can 
actually enhance the agency’s image. "There is the flip side of all this," said Joseph 
Alpher, a former high-ranking Mossad official. "Publicity around certain activities may 
attract people who want to do this kind of work." But the increasing number of 
headlines detailing mishaps actually expose some of the Mossad agents real tasks. 
They really are going after terrorists in Arab countries. They really are in Europe 
eavesdropping on the enemy. They really are meeting with operatives in Parisian 
cafes. "Everybody knows that if a mishap happens then it means the Mossad is very 
busy. When you are busy and doing a lot of operations, then inevitably there will be 
mishaps. The only way to really tell if the failures have had an effect is to get the 
figures on recruitment into the Mossad. Don’t hold your breath waiting for that 
statistic. 

► CUBA - MORE REVELATIONS FROM GRU DEFECTO R * The Cuban military has 
long run its own smaller but much more secret version of the Russians’ Lourdes 
electronic spying base, a unit known as the Electronic Warfare Battalion. Cuba does 
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not get copies of the communications intercepted at Lourdes, only copies of Russian 
intelligence summaries on issues that could affect the Island’s security^ said Stanislav 
Lunev, 50, a former colonel in Soviet military intelligence (GRU) who defected in 
Washington in 1992 while working as a TASS news agency correspondent. 

Adjoining the Russian base at El Wajay, nine miles southwest of Havana, is a 
Cuban-run "parallel signals intelligence operation". It is not clear just how powerful 
this centre is, but the defector said it could certainly pick up telephone and radio 
signals from Miami, 130 miles to the north. The Interior Ministry’s General 
Directorate for intelligence runs a separate radio listening and transmitting post 
elsewhere on the Island, apparently to stay in touch with its spies abroad, the defector 
added. The report also indicates that the Soviet Union learned of U.S. battle plans in 
the Persian Gulf War in 1991, including the surprise "left hook" into Iraq, through the 
electronic spy network in Cuba. Moscow did not leak the plans to Baghdad at the 
time, but improved Russian ! raqi relations may lead Moscow to be more friendly to 
President Saddam Hussein. Lunev said he had learned that Moscow was aware of 
Pentagon war plans when his GRU superiors asked him to analyse possible U.S. 
strategies based on secret cables sent by Moscow to the Soviet Embassy in 
Washington in late 1990 and early 1991. The cable summarised intercepts of U.S. 
communications, from chatter of U.S. warplane pilots in flight to the private 
telephone conversations of soldiers and their families. Lunev said he knew the 
information was from intercepts at Lourdes because of their coding, and because 
friends and officials at the GRU in Moscow had told him so when he had a holiday in 
Moscow soon after the war. 

Lourdes also receives and collates intercepts by spy satellites, ships and planes in the 
Atlantic region, making it a fully fledged regional command and control centre with 
some 2,000 Russian staff. U.S. officials reportedly suspect that Russian intelligence 
agents have recently been spying on the U.N. teams inspecting Iraq’s chemical and 
biological weapon sites, apparently to help Baghdad. 

Moscow’s Lourdes spy centre in Cuba which was built by the GRLJ in the 1970s is far 
bigger than publicly known, a "monster" that collates data intercepted by Russian spy 
satellites, ships and planes in the entire Atlantic region. A CIA spokesman would not 
comment on the claims but other U.S. Intelligence experts said Lunev’s description of 
Lourdes was on target and that he is a serious defector who has lectured at the 
Pentagon, CIA and NSA, which is in charge of U.S. electronic eavesdropping. 

► BRITAIN - SPYING OUT A MEW POSITION - Britain’s spymasters are 
recruiting again, this time with an anti-ageist approach. An advertisement in a South 
London newspaper, which covers MI5’s Thames House HQ, targeted older people 
looking for jobs as administrative assistants with MIS at a salary of £11,228. It said: Ir, 
an era of 25 year- old whizkids, it is natural to feel a few grey hairs do not enhance 
your employment prospects. Natural but wrong. But it cautioned: Try to avoid telling 
too many people about your application because discretion is a serious part of 
working for the security service.’ GCHQ entered the 1997 "Human Resources 
Excellence Awards" and were successful in winning an Award for Significant HR 
Achievement Under Difficult Circumstances. As GCHQ has become more 
market-facing and business-led, HR has played a key role in driving and supporting 
change. A number of personnel reforms have taken place under the umbrella of "The 
People Programme" which is underpinned by the GCHQ core competency framework. 



► RUSSIA - FOREIGN INTELLIGENCE SERVICE 'COMMENTS^ 

Yuriy Kobaladze head of the public and media relations bureau of the Russian Foreign Intelligence 
service was recently interviewed on Russian Radio. Points of interest to ENIGMA readers are 
detailed. 

(Q) Over the past few years, since the end of the Cold War, you have repeatedly said 
that industrial espionage is playing an important role. 

(A) I would not like to single out industrial espionage. Everyone knows we have the 
Foreign Intelligence Service and it continues to operate. But I have not heard of 
Paris, Washington or London disbanding their special services. On the contrary, we 
have official statements which show that, following the disappearance of the Soviet 
Union from the political map, the interests in Russia and other CIS countries has not 
decreased. We are not doing anything in London, Washington or Paris that the 
British, Americans or the French would not do in Moscow 

(O) What other countries are operating against Russia? 

(A) The number of countries engaged in intensive operations in Russia had increased 
and included Iran, China and North Korea. Most enterprises in which foreign secret 
services show interest are situated in the Moscow Region. 

(Q) Is Russian intelligence stepping up its activities? 

(A) No, it is not. Our major task is now restricted to gathering information about the 
countries where we operate, without interfering in their internal affairs. 

(Q) When the FIS was pari of the KGB, it was all called a power-wielding body. But 
is this the case today? 

(A) No, we are a special service, but we are not a power wielding body. Moreover, I 
would like to emphasize that we are not a law-enforcement agency. We do not catch 
anyone, neither have we anyone under surveillance. We operate abroad and we have 
no commandos capable of carrying out tasks that the former KGB used to carry out. 

► VATICAN CITY - MJKTfKR SHEDS LIGHT ON SPIES IN THE VATIC AN 
The Vatican City long time suspect of a Number Station operation was thrust into the 
spotlight recently when Swiss guard Vice-Corporal Cedric Tomay ,23, was accused of 
killing Colonel Alois Eslermann, 44, and his wife Gladys, 49. Tornay’s suicide note 
contained the ambiguous remark that "they" had forced him to commit the murder. A 
report in 'Berliner Kurier’ claims that Estermann, was a Stasi informer recruited 
in 1979 in Berne. From 1980 he was in the Vatican service, at the same time 
delivering information to German spymaster Markus Wolf. A spokesman for the 
former Stasi archives would only confirm that the East Germans had an agent in the 
Vatican between 1981 and 1984. His codename was "Werder". 

Alarmed by the appointment of a Polish pontif and his support for the Polish 
Solidarity trade union, the Warsaw Pact intelligence community targeted the Vatican. 
Polish, Hungarian, Czechoslovakian & Lithuanian priests were studied for their 
blackmail potential. Bulgarians were implicated in the plot to kill the Pope on May 13, 
1981’, they were connected with the Rome offices of Eastern European airlines. 
Passenger lists yielded useful information about Vatican employees who were en 
route to the East, and some employees acted as links between Vatican informers and 
their spy centres. 
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The intensity of the spying suggests that all parts of the Vatican were interesting for 
Eastern intelligence services: the bank (known as the Institute for Religious Works), 
the various secretariats the secret archives and the Swiss Guard. 

The close cooperation between the CIA and the Vatican during the 1980s stirred the 
interest of the Soviet-bloc spy agencies. The Pope was given access to satellite 
information, electronic eavesdropping reports and summaries of policy discussions at 
the White House, the State Department and the CIA. Between 1981 and 1988 
General Vernon Walters, a former CIA deputy director, was received seven times by 
the Pope for personal briefings. Vatican officials received classified information from 
the United States on Poland, Lithuania, Central America, on terrorism, on Chinese 
military power, on American and Soviet nuclear weaponry, and even on the nuclear 
ambitions of Pakistan (in the news again recently). The flow of information was 
naturally of some fascination to Moscow and its allies. 

> NATO - HUNGARY / CZECH REPUBL I C / PQIJVND : A report in the German news 
magazine "Spiegel" (Mirror) reported that the countries joining NATO - 
Hungaty/Czech Republic & Poland would still continue to send agents to other 
NATO partner countries. Military strengths will remain of particular interest, the 
report stated. The local "Mitteldeutsche Zeitung" reported that the Spiegel’s story had 
been confirmed by German government officials in Bonn, but Radio Budapest’s 
German service reported that the allegations were denied by the Bonn government. 

GERMANY - COMPUTER CONTAINING SECRETS GOES MISS IMG A crisis in 
the German state of Thuringia errupted when the Ministry of Interior relocated and 
lost two computers. The hard discs contained secret information from the 
Verfassungsschutz about Scientology, "V-men", and others. Officers of the Ministry 
should not have stored such information on computer disc. The trouble did not end 
there, when an unknown person entered the building and stole some documents. In 
the United States an unknown person entered the office of Secretaiy of State 
Madeleine Albright, leaving with documents. The FBI are investigating. 

fc- AUSTRALIA - UNITED STATES / AUSTRALIA SIGN MEW TREATY - The 
United States and Australia have signed a 10 - year renewal on the joint use of a spy 
facility in the Australian Outback. Foreign Minister Alexander Downer and U.S. 
Ambassador Genta Hawkins Holmes signed the renewal of the Pine gap treaty, 
originally signed in in 1967. Defence Minister Ian McLachlan said, This extension 
reflects the value of the Pine gap facility." It was used during the 1991 Gulf War to 
monitor Iraqi missile launches and troop movements. 

£ Acknowledgements for this section: Reuters, Wired Ventures, Inc. Mail on Sunday Newspaper, 
Intercepts via ’D\ BBC Radio 2, Simon Winchester/Island Magazine, Mike in Kent, Paul in London, 
Simon Davies/Daily Telegraph Newspaper, Ken in Doncaster, Jerusalem Post Newspaper, Arabic 
News. Juan O.Tamayo/Miami Herald, Washington Past, Andreas in Germany, Roger Boyes in Bonn. 
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Some notes on Direction Finding 

W@ are still intending to produce practical instructions for a 
reasonably reliable DF aerial and goniometer- However, until 
we get ENIGMA HQ's own DF facilities set up and working, we've 
decided to withhold these- In the meantime, this short 
article is intended to introduce the subject to those of you 
with little knowledge of professional DF systems. 

Accurate direction finding on HF is no easy matter. This is 
why Non-Direc tional Beacons, Decca (used for aeronautical - 
and maritime - navigation), and Datatrack (used by security 
companies etc.) operate on LF/MF. As we all know HF is 
subject to all kinds of propagations! effects - which never 
remain constant: day/night effects, multiple path, sun-spot 
cycle, fading, phase distortion etc- Without sophisticated DF 

facilities - and, at times, even with them - unreliable 
results and low accuracy are to be expected. 

Several of you have referred to using commercially available 
“HF loops**. Little success can be achieved with these, 
especially above about 3-5MHz at night, or 4-7MHz during the 
day (very approximate - depends an conditions). It's not 
worth attempting to DF a weak, fading station, at any time. A 
strong AM or Morse station with steady carrier has a higher 
degree of success. A sharp null is required* which 

corresponds to the ’'crossing'’ in the figure 8 polar diagram. 
Single loops of this kind rarely provide sharp enough nulls on 
HF, leading to a very wide angle aperture. Ideally we need 
better than 2 degrees. Loops may provide 10 degrees at best. 
A sense aerial is also required to determine the "sense" i.e* 
to eliminate the ambiguous reciprocal bearing associated with 
a loop's second null. The combination of the two aerials 

produces a cardioid polar diagram, however, its null is not as 
sharp as in the “figure of 8”, so the sense aerial needs to be 
switched out when not needed. In Britain, where most Numbers 
stations emanate from Continental Europe, a sense, aerial is 
less often needed as we know that most of our DF work involves 
the 45-115deg sector, and we can safely ignore reciprocal 
bearings. However, in Central Europe 360deg coverage is 
essential and a sense aerial absolutely necessary. 

One bearing doesn't make a “fix", of course. Two or preferably 
three or more bearings are required, with long base lines 
between monitoring sites - hundreds of miles/km when the 
target transmitter is a comparable distance away. Narrow and 
wide intercept angles give increasingly poor fixes. Ideally, 
for minimum error an intercept angle between two sites needs 
to be within approx. 65-115 degrees. Co-ordination between 
monitors is also needed. Known probable sites in the target 
zone can then be eliminated (or not 1 ) , and unknown sites 
sought out by various means. Final confirmation comes from 
visiting the suspect site with a field strength meter or 
crystal set* 



Pfbfessional monitoring agencies at their fixed sites use 
three main types of DF aerial, all non-rotatabl e : 

1. Adcock (& variants) - used extensively in WWII. 360deg 
coverage. Good results on small land area. An important 
variant is the CDAA (circularly-disposed antenna array) 
360deg„ More land needed. Used with dual diversity receivers 
and automated (fast motor-driven ) goniometers. Accurate to 
<ldeg„ Can respond to "burst' 1 transmissions , and can be 
adapted to plot and store real-time spectrum use. Widely used 
by monitoring agencies. Used by NSA at Menwith Hill, CSO at 
Irton Moor etc., DTI at Baldock (2), and until recently by the 
Foreign Office at Poundon . 

3. Phased loop array . A series of fixed crossed loops aligned 
in a particular direction. About HOdeg coverage. Two at 
right angles - 360deg« Examples can be seen at RN Forest 
Moor, RN Southwick etc., and until recently at HMGCC Poundon. 

4. HF interferometer - about iiOdeg coverage. High 
resolution. Needs a large long strip of land — a mile or so. 
The one at CSOS Cheadle is aligned N~S providing optimum 
coverage of Europe. 

All these aerials, being fixed, are rotated electronically by 
goniometers - ang ie-measuring/phase-changing devices. The 
basic type, as used with an Adcock, consists of two fixed 
coils at right angles to each other — with a central, 
manual I y-rotated search coil attached to a dial calibrated in 
degrees - which are aligned with True North. 

The only practical HF DF system we can use is the Adcock- 
derived aerial and goniometer. This consists of four vertical 
aperiodic (untuned) elements - rigid rods or wire attached to 
rJL gic I wooden poles. Each element is mounted at the corner of 
a square - about 4m sides or more. Four equal lengths of 
50ohm coaxial cable are used to link each element with the two 
stator coils of the gonio, their outer sheaths being attached 
to earth spikes at the base of each element, which may be 
joined together underground with bare wire. Throughout, the 
only critical consideration is the symmetry. As far as 
possible, everything must be symmetrical - square, feeder 
lengths, earthing, gonio coils. The square need not be 
aligned with True North, as the gonio dial can be calibrated 
by using bearings of known (strong) transmissions . 

%**%%%***% t **** t***t******k*%*%t ************ t ********** 

Many thanks to all of you who have written in. If your 
contributions haven't been included in this issue, this 
doesn't mean that they have been ignored. They will be made 
use of in the future. Special thanks go to Paul (for his 
excellent embassy and intelligence reports), Andreas, Hans- 
Friedrich, Guy (for the usual'.), Vassily, Rob, Richard, and 
the member who sent in the RIMNET details, and many more whose 
names escape me. . . 



oar ODDS AND ENDS 

Some things just don’t slot into a particular section so vie will cover them on this special page. 



© NEXT SOUTH-PAST MEETING - Following a successful meeting held on WED March 1 1th which 
was described as pleasant, informative and stimulating, a further meeting will be held in September. 
Remember, all are welcome. If you are interested please drop a note to the ENIGMA office and 
Mike (VC) will contact you or you can email him at < enigma.box@centrenet.co.uk> 

The venue will move around in order to attract more members. Next meeting details are: WED 9th 
SEPTEMBER 1998 - 7.30 PM, "The Rubbing House" public house (Nr Epsom Downs Racetrack, 
well sign-posted) Off M25 at Junction 8 onto A217, London bound (easily found at the junction of 3 
roads well in the dear) Easy access from M25, M23, M3, A3 and many minor roads. 

It is planned to hold two meetings per year. 

® SHQRTWAVF MAGAZINE - The British news stand magazine ’Shortwave Magazine’ have agreed 
for ENIGMA to carry a Numbers Page every other month, the first was published in April. We 
would like to welcome new readers to ENIGMA who responded to the feature. The Numbers page 
will aim to promote the subject and carries the ENIGMA mailing address. 

@ BACK ISSUES OF ENiGMA - We had an excellent response (thank you) to the rs-print of back 
issues. We now have very few of the lower (1-10) issues left. In future we hope to be able to offer 
the previous 3 issues (e g. 12, 13, 14, at present) for purchase. The publication of our ENIGMA 
Booklet should help to overcome the problems of searching for information through .numerous 
back copies. 

© INTERNET COVERAGE - We mentioned in the last issue that Mike (VC) spends a great deal of 
time searching and sifting through Internet material from a wide variety of sources. The Internet has 
developed at an alarming rate in recent years. We would like to ask readers (connected up or not) 
what information/addresses/coverage they would like. In recent issues we have mentioned sites of 
interest. Would readers like to have more sites/subjects listed or less? Or are we telling you about 
things which are of interest or not? Please let us know. 



Just a note to remind readers that we are still very 

interested in receiving any recordings of inactive stations and also any information about Number 
Stations of an historical nature. We are continuing to build up a picture of the evolution of certain 
stations. All information appreciated. 



® CORRECTIONS TO ISSUE 14 - 

Simon Mason Writes - Page 39 Para. 4. The reference to jamming of Phonetic Alphabet stations 
incorrectly referred to (E15) this should have read (E10). Typo error by ENIGMA - not Simon. 



News Round Up - Page 44. The reference to "Agents for Peace Call For Justice" Initiative Group" - 
the address omitted the city of Bonn. Full address is: Klaus von Raussendorff, An der Nesselburg 
81, Bonn 53179, GERMANY. 



Radio in the Gehten Organisation - Page 59. Para. 2. The reference to an "emergency receiver was 
tuned to prearranged wavelengths and hidden amongst the aerials of Radio Free Europe”. Should, 
of course, have read "an emergency transmitter*. The usual abbreviation for Organisation Gehlen is 
not “Org" but OG. The reference to Wittenberg should have read Wittenberge, a northern town. 



MESSAGE FOR ’D ’ Piease continue to supply ’Intelligence Monitor* pages from JIR - plus any back 
copies. Thanks for all other information. Still awaiting contact address. We cannot publish certain 
information due to lack of verification. 



E3 (Lincolnshire Poacher) Headers sent over period 1.5.95 to 30.11.95 



Message Period 

1.5.95 

15.5.95 

1.6.95 

15.6.95 

1.7.95 

15.7.95 

1.8.95 

15.8.95 

1.9.95 

15.9.95 

1.10.95 , 

15.10.95 

1.11.95 

15.11.95 



Schedule 
A B 



79891 

84231 

61259 

76525 

61015 

04454 

44333 

33238 

00768 

90792 

86656 

63467 

16957 

79171 



00283 

79127 

97581 

79575 

65297 

07982 

47630 

24378 

42613 

88364 

60075 

64593 

28773 

44173 



59922 

30253 

66960 

39694 

17341 

02928 

26795 

07601 

75086 

02044 

90335 

39715 

26818 

38418 




D2 



D3 



64793 

•36695 67894 

64793 



25602 

£3047 

17032 

18713 

13308 55542 

46967 27905 

65342 



34420 



E 

76728 

76750 

73424 

41704 

01609 

05396 

02441 

09375 

69701 

32966 

78750 

12729 

43479 

91950 



80368 

45694 

46427 

99265 

90752 

99371 

40984 

01090 

81913 

51814 

82001 

20309 

50974 

04257 



65182 

92099 

44808 

04860 

52547 

73494 

21769 

13053 

05991 

53768 

26764 

51478 

88997 

61614 



HI 

23092 
72685 
00374 
04766 . 
01362/ 



H2 

26225 

65742 

63742 

01362 



H3 



83318 

01362 



99424 

13805 

29246 

31180 

33414 

96270 

77576 



42324, 57330 
17438 

93318 33214 

70775 78417 

' 78524 
61232 99424 

00617 06095 

68013 19347 

05285 



II 

49656 

21224 

51404 

4370 2 

84017 

49326 

68697 

20196 

9525 5 

01966 

864 76 

74294 

28275 

31648 



12 

49639 

21267 

51423 

43786 

49394 

68540 

20086 

95222 

01885 

8648 3 

74219 



13 

49589 

21263 

43790 



99364 

95127 

01954 

86471 

74399 



The above sample has been chosen as it shows maximum use of the multiple-message schedules: 

D H & I. Certain significant features have been underlined. Until recently E3 headers were 
believed to be random - they are not entirely so. Note the same headers being repeated in 
D, H & I, e.g. H2 msg. 01362, 2nd of the 15.6 m.p., was repeated for the whole of the 1.7 m.p. 
and again for the 1st of the 1.8 m.p. Multiple I messages carry the same first 2 or 3 header 
digits, yet this does not apply to D & H. More significant still is that some headers begin with 
the same 3 digits exactly a year later. Two cases were noted when the second came exactly a 
month after the first. 58009 occurred in the 2nd August m.p. of 1996 and 1997. These patterns 
were mainly observed between 96/97, but also 97/98, yet not before 1996. All this refers to G 
headers,. P -.nothing significant. K - 1.5.95 & 15.5.95 both start 767** , and 15.2.97 & 15.6.97 
wete both 03022 - coincidence? C - 205** was noted 15.7.97 & 1.7.96; 55135 on 15.3.97 & 15.3.98 

- no coincidence. 72371 on 15.2.95 & 15.3.95. E - twice 1st 3 digits repeat, probably coincid- 
ence. A - 007**, noted 1.9.95 & 1.9.96, 907** : 15.9.95 & 15.9.96, 267** : 1.12.95/96, 634** ; 
is in QS/Qfi 169** • 1.11.95/96, 758** : 15.12.95/96, Others don’t fit the 1 year rule: 131- * 

15*8 96/ 1 3 96 *188** 1,7. 96/15 .2.97, 443** 1.8.95/15.1.98, 729** 13. 7.96/1.3.98/1.4.95, 866*-* 

6?«/ . i!«/i. 0.96 (the last also’with a 1 year ’fit’). As G 96/97 and 97/98 and A 95/96 headers are related, could A 
h^ihada task which was later taken over by G. If so, this would make transmissions even more difficult to follow. 

Thanks go to Andreas for his meticulous long-term monitoring of E3, and these new discoveries. 



m.p. 


13 14 


1.5 


£2.589 


15.5 


21263 


1.6 


- 


15.6 


43790 


1.7 


- 


15.7 


- 


M 


- 


15.8 


99364 


1.9 


95127 . - 


15.9 


01954 dl891 


1.10 


86471 86447 




74399 74345 


i.ii 


- 


15.11 


- 



86439 



cont. 
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